CVE-2019-3631: Command Injection could allow authenticated users to execute arbitrary code

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-27 · updated 2026-06-17
Weakness: CWE-78

Description

Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.

Affected products

McAfee, LLC McAfee Enterprise Security Manager (ESM): before 10.4.0; from 11.0.0 before 11.2.0 — fixed in 10.4.0, 11.2.0

How to fix

Upgrade to a fixed version: McAfee, LLC McAfee Enterprise Security Manager (ESM) 10.4.0, 11.2.0. Check the vendor advisory for mitigations.

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10284
https://kc.mcafee.com/corporate/index?page=content&id=SB10284

Get alerted when CVE-2019-3631 or the next vulnerability affects your stack