Lucene search

TrellixCVELIST:CVE-2021-23896

HistoryJun 02, 2021 - 1:10 p.m.

CVE-2021-23896 Cleartext Transmission of Sensitive Information in McAfee DBSec

2021-06-0213:10:15

CWE-319

trellix

www.cve.org

cve-2021-23896

cleartext transmission

sensitive information

CVSS3

3.2

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

12.6%

JSON

Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to view the unencrypted password of the McAfee Insights Server used to pass data to the Insights Server. This user is restricted to only have access to DBSec data in the Insights Server.

CNA Affected

[
  {
    "product": "McAfee Database Security (DBSec)",
    "vendor": "McAfee,LLC",
    "versions": [
      {
        "lessThan": "4.8.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

kc.mcafee.com/corporate/index?page=content&id=SB10359