CVE-2014-2587

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 3.1%

from disclosure to weapon0 days

Published on NVDMar 23

1st PoCMar 19

exploitation probability

3.1%top 13% of all CVEs

observed exploitation

nono source reports it

3 public exploit(s)

SQL injection vulnerability in jsp/reports/ReportsAudit.jsp in McAfee Asset Manager 6.6 allows remote authenticated users to execute arbitrary SQL commands via the username of an audit report (aka user parameter).

Affected products

n/a · n/a

public PoCs found — 3

exploitdbwww.exploit-db.com/exploits/32368unverified cve_referencepacketstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.htmlunverified cve_referencewww.exploit-db.com/exploits/32368unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/125775/McAfee-Cloud-SSO-Asset-Manager-Issues.html http://seclists.org/fulldisclosure/2014/Mar/325 https://exchange.xforce.ibmcloud.com/vulnerabilities/91929 http://www.exploit-db.com/exploits/32368 http://www.osvdb.org/104634 http://www.securityfocus.com/bid/66302 http://www.securitytracker.com/id/1029927