100581

http://packetstormsecurity.com/files/124277/McAfee-Email-Gateway-7.6-Command-Execution-SQL-Injection.html

20131203 McAfee Email Gateway multiple vulns

64150

mcafee-gateway-cve20137103-command-exec(90162)

The remote host is running a version of McAfee Email Gateway (MEG) that is affected by multiple SQL injection and command execution vulnerabilities:

  - Multiple SQL injections vulnerabilities exist in the     administrative web interface. A remote, authenticated     attacker could potentially exploit these vulnerabilities     to run arbitrary SQL commands. (CVE-2013-7092)

  - A command execution vulnerability exists in the     administrative web interface due to a failure to     sanitize user input to the 'TestFile' XML element. A     remote, authenticated attacker could potentially exploit     this vulnerability to run arbitrary shell commands.
    (CVE-2013-7103)

  - A command execution vulnerability exists in the     administrative web interface due to a failure to     sanitize user input to the 'Command' and 'Script' XML     attribute. A remote, authenticated attacker could     potentially exploit this vulnerability to run arbitrary     shell commands. (CVE-2013-7104)

CVE-2013-7103

high

Tenable Plugins

high