CVE-2018-6660: SB10228 ePO Directory Traversal vulnerability

Severity: medium (CVSS 4.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-02 · updated 2026-06-17
Weakness: CWE-22

Description

Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.

Affected products

McAfee,LLC McAfee ePolicy Orchestrator (ePO): 5.3.0, 5.3.1, 5.3.2, 5.9.0

References

http://www.securityfocus.com/bid/103392
http://www.securitytracker.com/id/1040884
https://kc.mcafee.com/corporate/index?page=content&id=SB10228
http://www.securityfocus.com/bid/103392
http://www.securitytracker.com/id/1040884
https://kc.mcafee.com/corporate/index?page=content&id=SB10228

Get alerted when CVE-2018-6660 or the next vulnerability affects your stack