Lucene search

IntelCVE-2017-3896

HistoryFeb 13, 2017 - 4:59 p.m.

CVE-2017-3896

2017-02-1316:59:00

CWE-20

intel

web.nvd.nist.gov

cve-2017-3896

unvalidated parameter vulnerability

remote log viewing

intel security

mcafee agent

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.5

Confidence

High

EPSS

0.006

Percentile

77.7%

JSON

Unvalidated parameter vulnerability in the remote log viewing capability in Intel Security McAfee Agent 5.0.x versions prior to 5.0.4.449 allows remote attackers to pass unexpected input parameters via a URL that was not completely validated.

Affected configurations

Nvd

Vulners

Node

mcafeemcafee_agentMatch5.0.0

mcafeemcafee_agentMatch5.0.1

mcafeemcafee_agentMatch5.0.2

mcafeemcafee_agentMatch5.0.3

mcafeemcafee_agentMatch5.0.4

VendorProductVersionCPE
mcafeemcafee_agent5.0.0cpe:2.3:a:mcafee:mcafee_agent:5.0.0:*:*:*:*:*:*:*
mcafeemcafee_agent5.0.1cpe:2.3:a:mcafee:mcafee_agent:5.0.1:*:*:*:*:*:*:*
mcafeemcafee_agent5.0.2cpe:2.3:a:mcafee:mcafee_agent:5.0.2:*:*:*:*:*:*:*
mcafeemcafee_agent5.0.3cpe:2.3:a:mcafee:mcafee_agent:5.0.3:*:*:*:*:*:*:*
mcafeemcafee_agent5.0.4cpe:2.3:a:mcafee:mcafee_agent:5.0.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mcafee	mcafee_agent	5.0.0	cpe:2.3:a:mcafee:mcafee_agent:5.0.0:::::::*
mcafee	mcafee_agent	5.0.1	cpe:2.3:a:mcafee:mcafee_agent:5.0.1:::::::*
mcafee	mcafee_agent	5.0.2	cpe:2.3:a:mcafee:mcafee_agent:5.0.2:::::::*
mcafee	mcafee_agent	5.0.3	cpe:2.3:a:mcafee:mcafee_agent:5.0.3:::::::*
mcafee	mcafee_agent	5.0.4	cpe:2.3:a:mcafee:mcafee_agent:5.0.4:::::::*

CNA Affected

[
  {
    "product": "McAfee Agent",
    "vendor": "Intel",
    "versions": [
      {
        "status": "affected",
        "version": "5.0.x versions prior to 5.0.4.449"
      }
    ]
  }
]

References

www.securityfocus.com/bid/95903

www.securitytracker.com/id/1037629

kc.mcafee.com/corporate/index?page=content&id=SB10183

Social References

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.5

Confidence

High

EPSS

0.006

Percentile

77.7%

JSON

Related for CVE-2017-3896