Cyber Resilience

CVE-2023-0978

Medium

Published: 13 March 2023

Published
13 March 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0035 57.7th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-0978 is a medium-severity Command Injection (CWE-77) vulnerability in Trellix Intelligent Sandbox. Its CVSS base score is 6.4 (Medium).

Operationally, ranked in the top 42.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This vulnerability is due to insufficient validation of arguments that…

more

are passed to specific CLI command. The vulnerability allows the attack

CWE(s)
CWE-77

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

mcafee
advanced threat defense
4.0 — 4.14.2
trellix
intelligent sandbox
5.0, 5.2

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References