Vulnerability Details : CVE-2021-23884
Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO administrator to view the unencrypted password of the McAfee Web Gateway (MWG) or the password of the McAfee Web Gateway Cloud Server (MWGCS) read only user used to retrieve log files for analysis in CSR.
Products affected by CVE-2021-23884
- cpe:2.3:a:mcafee:content_security_reporter:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-23884
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 10 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-23884
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.7
|
LOW | AV:A/AC:L/Au:S/C:P/I:N/A:N |
5.1
|
2.9
|
NIST | |
|
4.3
|
MEDIUM | CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |
0.7
|
3.6
|
NIST | |
|
4.3
|
MEDIUM | CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |
0.7
|
3.6
|
McAfee (DEFUNCT) | |
|
4.3
|
MEDIUM | CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N |
0.7
|
3.6
|
Trellix |
CWE ids for CVE-2021-23884
-
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.Assigned by:
- nvd@nist.gov (Primary)
- psirt@mcafee.com (Primary)
- trellixpsirt@trellix.com (Secondary)
References for CVE-2021-23884
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10353
McAfee Security Bulletin - Content Security Reporter update fixes one vulnerability (CVE-2021-23884)Broken Link
Jump to