« Volver al listado

CVE-2019-3631

Estado: ModificadaAlta (7.2)—

Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mcafee — Enterprise Security Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-3631",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "trellixpsirt@trellix.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.3
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "trellixpsirt@trellix.com",
      "affectedData": [
        {
          "vendor": "McAfee, LLC",
          "product": "McAfee Enterprise Security Manager (ESM)",
          "versions": [
            {
              "status": "affected",
              "version": "11.x",
              "lessThan": "11.2.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.x",
              "lessThan": "10.4.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-06-27T21:15:10.497",
  "references": [
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10284",
      "source": "trellixpsirt@trellix.com"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10284",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección  de comandos en McAfee Enterprise Security Manager (ESM) anterior a 11.2.0 y anterior a 10.4.0 permite que el usuario identificado ejecute códigos arbitrarios mediante parámetros creados especiales diseñados"
    }
  ],
  "lastModified": "2026-06-17T02:35:19.223",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:enterprise_security_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E05BFFB-218A-4B91-880F-F7F321485153",
              "versionEndExcluding": "10.4.0"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:enterprise_security_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5995933D-6186-46E1-9835-1760CEA6389D",
              "versionEndExcluding": "11.2.0",
              "versionStartIncluding": "11.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "trellixpsirt@trellix.com"
}