Vulnerability · Published Dec 8, 2021 · Assigned by trellix

CVE-2021-31850Denial of Service in Database Security on Windows

Medium 6.1

In plain English

A medium-severity security flaw in McAfee Database Security (DBSec) from McAfee,LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)1.0%top 37.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A denial-of-service vulnerability in Database Security (DBS) prior to 4.8.4 allows a remote authenticated administrator to trigger a denial-of-service attack against the DBS server. The configuration of Archiving through the User interface incorrectly allowed the creation of directories and files in Windows system directories and other locations where sensitive data could be overwritten. The former could lead to a DoS, whilst the latter could lead to data destruction on the DBS server.

Affected products (as reported)

Vendor	Product	Versions
McAfee,LLC	McAfee Database Security (DBSec)	unspecified – before 4.8.4

Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10358 x_refsource_CONFIRM
https://www.zerodayinitiative.com/advisories/ZDI-21-1535/ x_refsource_MISC