CVE-2023-0978: mcafee advanced threat defense +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2023-0978

CVSS 6.7 · Medium EPSS 0,37%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada mcafee advanced threat defense, trellix intelligent sandbox. Skor CVSS 3.1 6.7 (Medium) menurut NVD.

Deskripsi (NVD)

A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This vulnerability is due to insufficient validation of arguments that are passed to specific CLI command. The vulnerability allows the attack

Rincian

Terbit di NVD: 13 Maret 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
EPSS (30 hari): 0,37% peluang dieksploitasi; lebih tinggi dari 29,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
mcafee	advanced threat defense	Versi 4.0 hingga 4.14.2
trellix	intelligent sandbox	Versi 5.0
trellix	intelligent sandbox	Versi 5.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://kcm.trellix.com/corporate/index?page=content&id=SB10397 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.