PT-2017-16181 · Mcafee · Mcafee Advanced Threat Defense

Published 2017-07-12 · Updated 2017-07-17 · CVE-2017-4052

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions McAfee Advanced Threat Defense (ATD) versions 3.4 through 3.10

Description The issue allows remote unauthenticated users to bypass authentication in the web interface, enabling them to change or update configuration settings or gain administrator functionality by sending a crafted HTTP request parameter.

Recommendations For versions 3.4 through 3.10, update to a version that includes a fix for this issue to prevent authentication bypass and unauthorized access to configuration settings.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2017-4052

Affected Products

Mcafee Advanced Threat Defense

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-4052 · Security Note
• https://osv.dev/vulnerability/CVE-2017-4052 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10204 · Vendor Advisory
• http://securityfocus.com/bid/99557 · Note