PT-2017-16174 · Mcafee · Mcafee Network Data Loss Prevention

Publicado 2017-05-17 · Atualizado 2017-07-08 · CVE-2017-4011

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions McAfee Network Data Loss Prevention (NDLP) versions 9.3.x

Description The issue allows remote attackers to obtain session or cookie information by modifying the HTTP request, which can lead to unauthorized access. This is due to an Embedding Script (XSS) in HTTP Headers vulnerability in the server.

Recommendations For McAfee Network Data Loss Prevention (NDLP) versions 9.3.x, consider restricting access to sensitive information and session cookies until a fix is available. As a temporary workaround, review and limit the modification of HTTP requests to prevent exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-4011

Produtos afetados

Mcafee Network Data Loss Prevention

Referências · 4

• https://kc.mcafee.com/corporate/index?page=content&id=SB10198 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-4011 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-4011 · Nota de Segurança
• http://securitytracker.com/id/1038523 · Nota