Read the docs
TI-2021-06248 Aliases CVE-2021-23894GHSA-86cp-mgj2-w853

Unauthorized deserialization of untrusted data in McAfee DBSec

Priority MEDIUM 46CWE-502Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Deserialization of untrusted data vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows a remote unauthenticated attacker to create a reverse shell with administrator privileges on the DBSec server via carefully constructed Java serialized object sent to the DBSec server.

Why it matters now

EPSS 0.02242 82nd percentileScored 2026-11-07
Fix Fixed McAfee Database Security (DBSec) (McAfee,LLC): 4.8.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Database Security (DBSec)before 4.8.24.8.2Patch availableCNA
  • McAfee Database Security (DBSec) VendorMcAfee Affected before 4.8.2 Fixed in 4.8.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:database_security:*:*:*:*:*:*:*:*before 4.8.2VulnerableMcAfee
  • cpe:2.3:a:mcafee:database_security:*:*:*:*:*:*:*:* Versions before 4.8.2 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Database Security (DBSec) (McAfee,LLC) Fixed in 4.8.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    McAfee,LLC McAfee Database Security (DBSec) 4.8.2

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2021-06249 Authorized deserialization of untrusted data in McAfee DBSecPriority MEDIUM 43
    • TI-2021-06250 Cleartext Transmission of Sensitive Information in McAfee DBSecPriority LOW 20
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23894
  2. 2026-10-03 Alias added: GHSA-86cp-mgj2-w853

References

Other 1

  • TI-2021-06249 Authorized deserialization of untrusted data in McAfee DBSec CVSS 3.1CRITICAL 9.0
  • TI-2019-02666 Data Leakage Vulnerability in McAfee Database Security web interface CVSS 3.0MEDIUM 6.8
  • TI-2021-11843 Denial of Service in Database Security on Windows CVSS 3.1MEDIUM 6.1
  • TI-2021-11824 Cross site Scripting (XSS) vulnerability in McAfee DBSec CVSS 3.1MEDIUM 5.9
  • TI-2020-05941 Database Security(DBS)-Use of a Broken or Risky Cryptographic Algorithm CVSS 3.1MEDIUM 6.3
  • TI-2021-11825 Incorrect access to deleted scripts vulnerability in McAfee DBSec CVSS 3.1MEDIUM 5.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences