CVE-2021-31850 Denial of Service in Database Security on Windows
Remote authenticated administrators can cause denial of service or data destruction via improper directory creation in Windows system locations.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-31850?
CVE-2021-31850 is a medium-severity path traversal vulnerability in McAfee,LLC McAfee Database Security (DBSec), published on 8 Dec 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
A denial-of-service vulnerability in Database Security (DBS) prior to 4.8.4 allows a remote authenticated administrator to trigger a denial-of-service attack against the DBS server. The configuration of Archiving through the User interface incorrectly allowed the creation of directories and files in Windows system directories and other locations where sensitive data could be overwritten. The former could lead to a DoS, whilst the latter could lead to data destruction on the DBS server.
Weakness: CWE-552
Which versions are affected by CVE-2021-31850?
It affects 1 product.
Products include Mcafee Database Security.
How do I fix CVE-2021-31850?
No fix has been published for CVE-2021-31850 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-31850 being exploited?
There is no known exploitation of CVE-2021-31850 in the wild and no public exploit code.
Other vulnerabilities in McAfee,LLC McAfee Database Security (DBSec)
- CVE-2021-23894 Unauthorized deserialization of untrusted data in McAfee DBSec
- CVE-2021-23895 Authorized deserialization of untrusted data in McAfee DBSec
- CVE-2020-7339 Database Security(DBS)-Use of a Broken or Risky Cryptographic Algorithm
- CVE-2021-31830 Cross site Scripting (XSS) vulnerability in McAfee DBSec
- CVE-2019-3615 Data Leakage Vulnerability in McAfee Database Security web interface
Sources
Also known as GHSA-6wc6-p7fm-qqjp.