CVE-2013-7461

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A write protection and execution bypass vulnerability in McAfee (now Intel Security) Change Control (MCC) 6.1.0 for Linux and earlier allows authenticated users to change files that are part of write protection rules via specific conditions.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Intel	Change Control (MCC)	6.1.0 for Linux and earlier

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10054Patch, Vendor Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10054Patch, Vendor Advisory

Timeline

Published: Mar 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-74627.5A directory traversal vulnerability in the web application in McAfee (now Intel Security) SaaS Control Console (SCC) Platform 6.14 before pa CVE-2013-74637.5The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows CVE-2013-74648.8In csrf-magic before 1.0.4, if $GLOBALS['csrf']['secret'] is not configured, the Anti-CSRF Token used is predictable and would permit an att CVE-2013-74659.8Ice Cold Apps Servers Ultimate 6.0.2(12) does not require authentication for TELNET, SSH, or FTP, which allows remote attackers to execute a CVE-2013-74668.8Simple Machines Forum (SMF) 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traver CVE-2013-74676.1Simple Machines Forum (SMF) 2.0.4 allows XSS via the index.php?action=pm;sa=settings;save sa parameter.CVE-2013-74688.1Simple Machines Forum (SMF) 2.0.4 allows PHP Code Injection via the index.php?action=admin;area=languages;sa=editlang dictionary parameter.CVE-2013-74697.5Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making CVE-2013-74705.9cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause CVE-2013-74719.8An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, CVE-2013-74726.1The "Count per Day" plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.CVE-2013-74738.8Windu CMS 2.2 allows CSRF via admin/users/?mn=admin.message.error to add an admin account.