PT-2018-7316 · Mcafee · Mcafee Network Security Management

Published 2018-04-04 · Updated 2019-10-09 · CVE-2017-3966

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: McAfee Network Security Management (NSM) versions prior to 8.2.7.42.2

Description: The issue concerns the exploitation of session variables, resource IDs, and other trusted credentials in the web interface. This allows remote attackers to harm a user's browser by reusing the exposed session token in the application URL.

Recommendations: For versions prior to 8.2.7.42.2, update to version 8.2.7.42.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid reusing session tokens in application URLs until the issue is resolved.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2017-3966

Affected Products

Mcafee Network Security Management

References · 3

• https://osv.dev/vulnerability/CVE-2017-3966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3966 · Security Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10192 · Note