PT-2019-16643 · Mcafee · Mcafee Web Gateway

Published 2019-09-12 · Updated 2022-12-13 · CVE-2019-3638

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions McAfee Web Gateway versions 7.8.x prior to 7.8.2.13

Description The issue allows remote attackers to collect sensitive information or execute commands with the administrator's credentials by tricking the administrator into clicking on a malicious link. This is a Reflected Cross Site Scripting vulnerability in the Administrators web console.

Recommendations For McAfee Web Gateway versions 7.8.x prior to 7.8.2.13, update to version 7.8.2.13 or later to resolve the issue. As a temporary workaround, consider restricting access to the Administrators web console to minimize the risk of exploitation. Avoid clicking on suspicious links, especially those that may be constructed to exploit this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-3638

Affected Products

Mcafee Web Gateway

References · 4

• https://osv.dev/vulnerability/CVE-2019-3638 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3638 · Security Note
• https://t.me/cvenotify/39756 · Telegram Post
• https://kc.mcafee.com/corporate/index?page=content&id=SB10294 · Note