CVE-2017-3965: high-severity vulnerability in McAfee Network Security Management (NSM)
SB10192 - Network Security Management (NSM) - Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.5%
Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to perform unauthorized tasks such as retrieving internal system information or manipulating the database via specially crafted URLs.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
McAfee · Network Security Management (NSM)Related CVEs — McAfee Network Security Management (NSM)
In the same product, most dangerous first.
CVE-2017-3968HIGHMcAfee Network Security Management (NSM) and Network Data Loss Prevention (NDLP)- Password recovery exploitation vulnerabilityEPSS 1.5%CVE-2017-3972HIGHSB10192 - Network Security Management (NSM) - Infrastructure-based foot printing vulnerabilityEPSS 1.5%CVE-2017-3960MEDIUMMcAfee Network Security Management (NSM) - Exploitation of Authorization vulnerabilityEPSS 0.9%CVE-2017-3969HIGHSB10192 - Network Security Management (NSM) - Abuse of communication channels vulnerabilityEPSS 0.8%CVE-2017-3967MEDIUMSB10192 - Network Security Management (NSM) - Target influence via framing vulnerabilityEPSS 0.7%CVE-2017-3966MEDIUMSB10192 - Network Security Management (NSM) - Exploitation of session variables, resource IDs and other trusted credentials vulnerabilityEPSS 0.7%