Critical severity · published Jun 26, 2018
CVE-2018-6667
Authentication Bypass vulnerability in the administrative user interface in McAfee Web Gateway 7.8.1.0 through 7.8.1.5 allows remote attackers to execute arbitrary code via Java…
9.8
CVSS
3.5%
EPSS
No
On KEV
Description
Authentication Bypass vulnerability in the administrative user interface in McAfee Web Gateway 7.8.1.0 through 7.8.1.5 allows remote attackers to execute arbitrary code via Java management extensions (JMX).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.5% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
Mcafee Web Gateway · Mcafee
7.8.1.0 through 7.8.1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6667
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6667
www.securityfocus.com
http://www.securityfocus.com/bid/104564
www.securitytracker.com
http://www.securitytracker.com/id/1041129
kc.mcafee.com
https://kc.mcafee.com/corporate/index?page=content&id=SB10241
More from Mcafee Web Gateway
9.1
CVE-2018-6678
Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to execute…
9.1
CVE-2018-6677
Directory Traversal vulnerability in the administrative user interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to gain elevated privileges…
7.5
CVE-2019-3581
Improper input validation in the proxy component of McAfee Web Gateway 7.8.2.0 and later allows remote attackers to cause a denial of service via a crafted HTTP request parameter