PT-2019-4244 · Mcafee · Mcafee Advanced Threat Defense
Publicado
2019-11-12
·
Atualizado
2021-07-21
·
CVE-2019-3649
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
McAfee Advanced Threat Defense versions prior to 4.8
Description
The issue exists due to insufficient input validation, allowing a remote attacker to gain unauthorized access to protected information using specially crafted POST requests. This can lead to information disclosure, where remote authenticated attackers can access hashed credentials via carefully constructed POST requests that extract incorrectly recorded data from log files.
Recommendations
For versions prior to 4.8, update to version 4.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the log files to minimize the risk of exploitation. Avoid using the vulnerable function related to log file handling until the issue is resolved.
Correção
RCE
Information Disclosure
Insertion into Log File
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Mcafee Advanced Threat Defense