CVE-2017-3968

Published: Jun 13, 2018Modified: Nov 21, 2024

9.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie.

Affected (2)

Products: Mcafee: Network Data Loss Prevention, Network Security Manager

2 products

Network Data Loss Prevention

Network Security Manager

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mcafee Network Data Loss Prevention	Before 9.3.4.1.5
Mcafee Network Security Manager	Before 8.2.7.42.2

Related CWEs

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (4)

https://kc.mcafee.com/corporate/index?page=content&id=SB10192

Source: trellixpsirt@trellix.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10198

Source: trellixpsirt@trellix.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10192

Source: af854a3a-2127-422b-91ae-364da2661108

https://kc.mcafee.com/corporate/index?page=content&id=SB10198

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.