PT-2017-9456 · Mcafee · Mcafee Security Information/Event Management

Claudio Cinquino + 1 · Published 2017-01-05 · Updated 2017-01-18 · CVE-2016-8006

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions McAfee Security Information and Event Management (SIEM) version 9.6.0 MR3

Description An issue in McAfee Security Information and Event Management (SIEM) allows an administrator to bypass authentication and make changes to other SIEM users' information, including user passwords, without providing the current administrator password a second time via the GUI or GUI terminal commands.

Recommendations For McAfee Security Information and Event Management (SIEM) version 9.6.0 MR3, consider restricting access to user information management features until a fix is available. As a temporary workaround, limit the use of the GUI and GUI terminal commands for making changes to user passwords to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-8006

Affected Products

Mcafee Security Information/Event Management

References · 6

• https://osv.dev/vulnerability/CVE-2016-8006 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=KB87744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8006 · Security Note
• http://quantumleap.it/mcafee-siem-esm-esmrec-authentication-bypass-vulnerability · Note
• http://securityfocus.com/bid/95313 · Note
• https://narthar.it/DOC/McAfee_SIEM_9.6_Authentication_bypass_vulnerability.html · Note