7.2

CVE-2003-0148

The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that (1) obtain the database administrator username and encrypted password in a configuration file from the ePO server using a certain request, (2) crack the password due to weak cryptography, and (3) use the password to pass commands through xp_cmdshell.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mcafee ≫ Epolicy Orchestrator Version2.0
Mcafee ≫ Epolicy Orchestrator Version2.5
Mcafee ≫ Epolicy Orchestrator Version2.5 Updatesp1
Mcafee ≫ Epolicy Orchestrator Version2.5.1
Mcafee ≫ Epolicy Orchestrator Version3.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.56% 0.42
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.atstake.com/research/advisories/2003/a073103-1.txt
Patch
Vendor Advisory
http://www.nai.com/us/promos/mcafee/epo_vulnerabilities.asp
Patch
Vendor Advisory