Session Hijacking Vulnerability in McAfee Network Data Loss Prevention Server
CVE-2017-4014

8HIGH

Key Information:

Vendor
Mcafee
Status
Network Data Loss Prevention (ndlp)
Vendor
CVE Published:
17 May 2017

Summary

A session hijacking vulnerability exists within the McAfee Network Data Loss Prevention server, specifically affecting version 9.3.x. This flaw enables remote authenticated users to exploit the HTTP session management, allowing them to view, add, and remove users through crafted HTTP requests. Attackers could leverage this vulnerability to manipulate user sessions, potentially compromising sensitive information and user integrity.

Affected Version(s)

Network Data Loss Prevention (NDLP) 9.3.x

References

https://kc.mcafee.com/corporate/index?page=content&id=SB1...
x_refsource_CONFIRM
http://www.securitytracker.com/id/1038523
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.