PT-2017-16174 · Mcafee · Mcafee Network Data Loss Prevention

Published 2017-05-17 · Updated 2017-07-08 · CVE-2017-4011

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions McAfee Network Data Loss Prevention (NDLP) versions 9.3.x

Description The issue allows remote attackers to obtain session or cookie information by modifying the HTTP request, which can lead to unauthorized access. This is due to an Embedding Script (XSS) in HTTP Headers vulnerability in the server.

Recommendations For McAfee Network Data Loss Prevention (NDLP) versions 9.3.x, consider restricting access to sensitive information and session cookies until a fix is available. As a temporary workaround, review and limit the modification of HTTP requests to prevent exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-4011

Affected Products

Mcafee Network Data Loss Prevention

References · 4

• https://kc.mcafee.com/corporate/index?page=content&id=SB10198 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-4011 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4011 · Security Note
• http://securitytracker.com/id/1038523 · Note