Webadvisor
Monthly
Unauthenticated XML External Entity (XXE) injection in Ellucian WebAdvisor 3.2 lets remote attackers POST crafted XML to the /WebAdvisor/WebAdvisor endpoint and abuse an XML parser that has external entity and DTD resolution left enabled, yielding server-side request forgery, coerced NTLMv2 hash disclosure to an attacker-controlled SMB share, and arbitrary file read from the underlying Windows host through an out-of-band error-based channel. No authentication or user interaction is required (CVSS vector shows AV:N/PR:N/UI:N), and impact is confined to confidentiality with no integrity or availability effect; the vendor-published CVSS 4.0 score is 8.7 while our independent assessment rates the same vector as high confidentiality impact only. No public exploit code has been identified at time of analysis, and real-world exposure is limited to legacy higher-education deployments because WebAdvisor reached end-of-support in June 2022.
Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfee WebAdvisor settings and other details. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
API Abuse/Misuse vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to navigate to restricted websites via a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Code Injection vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to render a website which Web Advisor would. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated XML External Entity (XXE) injection in Ellucian WebAdvisor 3.2 lets remote attackers POST crafted XML to the /WebAdvisor/WebAdvisor endpoint and abuse an XML parser that has external entity and DTD resolution left enabled, yielding server-side request forgery, coerced NTLMv2 hash disclosure to an attacker-controlled SMB share, and arbitrary file read from the underlying Windows host through an out-of-band error-based channel. No authentication or user interaction is required (CVSS vector shows AV:N/PR:N/UI:N), and impact is confined to confidentiality with no integrity or availability effect; the vendor-published CVSS 4.0 score is 8.7 while our independent assessment rates the same vector as high confidentiality impact only. No public exploit code has been identified at time of analysis, and real-world exposure is limited to legacy higher-education deployments because WebAdvisor reached end-of-support in June 2022.
Improper access control vulnerability in McAfee WebAdvisor Chrome and Edge browser extensions up to 8.1.0.1895 allows a remote attacker to gain access to McAfee WebAdvisor settings and other details. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
API Abuse/Misuse vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to navigate to restricted websites via a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Code Injection vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to render a website which Web Advisor would. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.