PT-2018-7316 · Mcafee · Mcafee Network Security Management

Publicado 2018-04-04 · Atualizado 2019-10-09 · CVE-2017-3966

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: McAfee Network Security Management (NSM) versions prior to 8.2.7.42.2

Description: The issue concerns the exploitation of session variables, resource IDs, and other trusted credentials in the web interface. This allows remote attackers to harm a user's browser by reusing the exposed session token in the application URL.

Recommendations: For versions prior to 8.2.7.42.2, update to version 8.2.7.42.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid reusing session tokens in application URLs until the issue is resolved.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

CVE-2017-3966

Produtos afetados

Mcafee Network Security Management

Referências · 3

• https://kc.mcafee.com/corporate/index?page=content&id=SB10192 · Nota
• https://osv.dev/vulnerability/CVE-2017-3966 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-3966 · Nota de Segurança