CVE-2013-7104: mcafee email_gateway OS Command Injection

Vulnerability summary

CVE-2013-7104 is a high (CVSS 9.0) OS Command Injection vulnerability in mcafee email_gateway. EPSS estimates a 3.88% chance of exploitation in the next 30 days, higher than 90.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 14-12-2013
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands by specifying them in the value attribute in a (1) Command or (2) Script XML element. NOTE: this issue can be combined with CVE-2013-7092 to allow remote attackers to execute commands.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.