High severity · published Mar 14, 2017
CVE-2015-8988
Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows authenticated users to…
8.8
CVSS
1.1%
EPSS
No
On KEV
Description
Unquoted executable path vulnerability in Client Management and Gateway components in McAfee (now Intel Security) ePO Deep Command (eDC) 2.2 and 2.1 allows authenticated users to execute a command of their choice via dropping a malicious file for the path.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
Epo Deep Command · Mcafee
2.1; 2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-8988
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-8988
Patch
https://kc.mcafee.com/corporate/index?page=content&id=SB10115
More from Epo Deep Command
–
CVE-2015-3987
Multiple unquoted Windows search path vulnerabilities in the (1) Client Management and (2) Gateway in McAfee ePO Deep Command 2.1 and 2.2 before HF 1058831 allow local users to…