Read the docs
TI-2021-11843 Aliases CVE-2021-31850GHSA-6wc6-p7fm-qqjp

Denial of Service in Database Security on Windows

Priority LOW 29CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-552.

Summary

A denial-of-service vulnerability in Database Security (DBS) prior to 4.8.4 allows a remote authenticated administrator to trigger a denial-of-service attack against the DBS server. The configuration of Archiving through the User interface incorrectly allowed the creation of directories and files in Windows system directories and other locations where sensitive data could be overwritten. The former could lead to a DoS, whilst the latter could lead to data destruction on the DBS server.

Why it matters now

EPSS 0.00999 62nd percentileScored 2026-11-07
Fix Fixed McAfee Database Security (DBSec) (McAfee,LLC): 4.8.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Database Security (DBSec)before 4.8.44.8.4Patch availableCNA
  • McAfee Database Security (DBSec) VendorMcAfee Affected before 4.8.4 Fixed in 4.8.4 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:database_security:*:*:*:*:*:*:*:*before 4.8.4VulnerableMcAfee
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:mcafee:database_security:*:*:*:*:*:*:*:* Versions before 4.8.4 Vulnerable ·McAfee
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA McAfee Database Security (DBSec) (McAfee,LLC) Fixed in 4.8.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-31850
  2. 2026-10-03 Alias added: GHSA-6wc6-p7fm-qqjp

References

Other 2

  • TI-2021-06248 Unauthorized deserialization of untrusted data in McAfee DBSec CVSS 3.1CRITICAL 9.6
  • TI-2021-06249 Authorized deserialization of untrusted data in McAfee DBSec CVSS 3.1CRITICAL 9.0
  • TI-2019-02666 Data Leakage Vulnerability in McAfee Database Security web interface CVSS 3.0MEDIUM 6.8
  • TI-2021-11824 Cross site Scripting (XSS) vulnerability in McAfee DBSec CVSS 3.1MEDIUM 5.9
  • TI-2020-05941 Database Security(DBS)-Use of a Broken or Risky Cryptographic Algorithm CVSS 3.1MEDIUM 6.3
  • TI-2021-11825 Incorrect access to deleted scripts vulnerability in McAfee DBSec CVSS 3.1MEDIUM 5.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences