CVE-2015-7310 Command injection in n/a

What is CVE-2015-7310?

CVE-2015-7310 is a medium-severity command injection vulnerability in n/a, published on 22 Sep 2015. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before 9.5.0MR7 allow remote authenticated users to execute arbitrary OS commands via a crafted filename, which is not properly handled when downloading the file.

Weakness: CWE-78

Which versions are affected by CVE-2015-7310?

It affects 3 products.

Products include Mcafee Enterprise Security Manager, Mcafee Enterprise Security Manager\/Log Manager, Mcafee Enterprise Security Manager\/Receiver.

How do I fix CVE-2015-7310?

No fix has been published for CVE-2015-7310 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2015-7310 being exploited?

There is no known exploitation of CVE-2015-7310 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2019-3632 Directory Traversal vulnerability could lead to elevated privileges High 8.5
• CVE-2019-3629 Application protections bypass vulnerability could allow unauthenticated user to impersonate system users High 8.3
• CVE-2019-3630 Command Injection could allow authenticated users to execute arbitrary code High 8.0
• CVE-2019-3631 Command Injection could allow authenticated users to execute arbitrary code High 8.0
• CVE-2019-3628 Privilege escalation could allow authenticated user to gain access to a core system High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x85c-wgp5-v66x.