Critical severity · published Jul 23, 2018
CVE-2018-6677
Directory Traversal vulnerability in the administrative user interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to gain elevated privileges…
9.1
CVSS
2.1%
EPSS
No
On KEV
Description
Directory Traversal vulnerability in the administrative user interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to gain elevated privileges via unspecified vectors.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
Mcafee Web Gateway · Mcafee
7.8.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-6677
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-6677
www.securityfocus.com
http://www.securityfocus.com/bid/104893
kc.mcafee.com
https://kc.mcafee.com/corporate/index?page=content&id=SB10245
More from Mcafee Web Gateway
9.8
CVE-2018-6667
Authentication Bypass vulnerability in the administrative user interface in McAfee Web Gateway 7.8.1.0 through 7.8.1.5 allows remote attackers to execute arbitrary code via Java…
9.1
CVE-2018-6678
Configuration/Environment manipulation vulnerability in the administrative interface in McAfee Web Gateway (MWG) MWG 7.8.1.x allows authenticated administrator users to execute…
7.5
CVE-2019-3581
Improper input validation in the proxy component of McAfee Web Gateway 7.8.2.0 and later allows remote attackers to cause a denial of service via a crafted HTTP request parameter