Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2011-3007

The myCIOScn ActiveX control (myCIOScn.dll) in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter, as demonstrated by injecting script into a log file and executing arbitrary code using the MyCioScan.Scan.Start method.

Published

2011-08-10T20:55:01.783

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 6.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.6

Impact Score

6.4

Weaknesses

Type: Primary
CWE-94

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mcafee	saas_endpoint_protection	≤ 5.2.1	Yes

References

http://dvlabs.tippingpoint.com/advisory/TPTI-11-13 ([email protected])
http://osvdb.org/74513 ([email protected])
https://exchange.xforce.ibmcloud.com/vulnerabilities/69093 ([email protected])
https://kc.mcafee.com/corporate/index?page=content&id=SB10016 Vendor Advisory ([email protected])
http://dvlabs.tippingpoint.com/advisory/TPTI-11-13 (af854a3a-2127-422b-91ae-364da2661108)
http://osvdb.org/74513 (af854a3a-2127-422b-91ae-364da2661108)
https://exchange.xforce.ibmcloud.com/vulnerabilities/69093 (af854a3a-2127-422b-91ae-364da2661108)
https://kc.mcafee.com/corporate/index?page=content&id=SB10016 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)