CVE-2017-3980

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice via an authenticated ePO session.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
McAfee	ePolicy Orchestrator (ePO)	5.9.0 and earlier; 5.3.2 and earlier; 5.1.3 and earlier

References

http://www.securityfocus.com/bid/98559Third Party Advisory, VDB Entry
https://kc.mcafee.com/corporate/index?page=content&id=SB10196Vendor Advisory
http://www.securityfocus.com/bid/98559Third Party Advisory, VDB Entry
https://kc.mcafee.com/corporate/index?page=content&id=SB10196Vendor Advisory

Timeline

Published: May 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-40116.1Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attacke CVE-2017-40126.5Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to vi CVE-2017-40135.3Banner Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to obtain product information vi CVE-2017-40148.0Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to vi CVE-2017-40154.5Clickjacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to inject arb CVE-2017-40165.3Web Server method disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to exploit and find a CVE-2017-40175.3User Name Disclosure in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to view user information via CVE-2017-40284.4Maliciously misconfigured registry vulnerability in all Microsoft Windows products in McAfee consumer and corporate products allows an admin CVE-2017-40529.8Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthent CVE-2017-40539.8Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticat CVE-2017-40548.8Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote authenticated CVE-2017-40557.5Exploitation of Authentication vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote