Missing HTTP Strict Transport Security in McAfee Network Data Loss Prevention

CVE-2017-3934

Summary

The vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x involves a missing HTTP Strict Transport Security (HSTS) state information. This flaw allows an attacker to conduct man-in-the-middle attacks, potentially exposing sensitive data by gaining unauthorized access to files read from the webserver. Organizations using the affected version should prioritize patching this vulnerability to mitigate the risks associated with improper handling of sensitive information.

References