Vulnerability Details : CVE-2017-3968
Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie.
Products affected by CVE-2017-3968
- cpe:2.3:a:mcafee:network_security_manager:*:*:*:*:*:*:*:*
- cpe:2.3:a:mcafee:network_data_loss_prevention:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-3968
0.31%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 67 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-3968
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:P/A:N |
10.0
|
4.9
|
NIST | |
9.1
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
3.9
|
5.2
|
NIST | |
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L |
1.7
|
5.3
|
McAfee (DEFUNCT) |
CWE ids for CVE-2017-3968
-
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-3968
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10198
McAfee Security Bulletin - Network Data Loss Prevention update fixes eleven vulnerabilities (CVE-2017-3933, CVE-2017-3934, CVE-2017-3935, CVE-2017-3968, CVE-2017-4011, CVE-2017-4012, CVE-2017-4013, CVVendor Advisory
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10192
McAfee - Security Bulletin: Network Security Manager updates fix CVE-2017-3960, CVE-2017-3961, CVE-2017-3962, CVE-2017-3964, CVE-2017-3965, CVE-2017-3966, CVE-2017-3967, CVE-2017-3968, CVE-2017-3969,Vendor Advisory
Jump to