CVEvulnerability
CVE-2011-3007
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-08-10
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-94
Description
The myCIOScn ActiveX control (myCIOScn.dll) in McAfee SaaS Endpoint Protection 5.2.1 and earlier allows remote attackers to write to arbitrary files by specifying an arbitrary filename in the MyCioScan.Scan.ReportFile parameter, as demonstrated by injecting script into a log file and executing arbitrary code using the MyCioScan.Scan.Start method.
Affected configurations
• mcafee saas endpoint protection (<= 5.2.1)
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://dvlabs.tippingpoint.com/advisory/TPTI-11-13 dvlabs.tippingpoint.com
- http://osvdb.org/74513 osvdb.org
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69093 exchange.xforce.ibmcloud.com
- https://kc.mcafee.com/corporate/index?page=content&id=SB10016 Vendor Advisory
- http://dvlabs.tippingpoint.com/advisory/TPTI-11-13 dvlabs.tippingpoint.com
- http://osvdb.org/74513 osvdb.org
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69093 exchange.xforce.ibmcloud.com
- https://kc.mcafee.com/corporate/index?page=content&id=SB10016 Vendor Advisory