« Volver al listado

CVE-2017-3933

Estado: ModificadaMedia (5.4)—

Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mcafee — Network Data Loss Prevention

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-3933",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "secure@intel.com",
      "affectedData": [
        {
          "vendor": "McAfee",
          "product": "Network Data Loss Prevention",
          "versions": [
            {
              "status": "affected",
              "version": "9.3.X"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-10-31T14:29:00.320",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/101628",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10198",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@intel.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/101628",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10198",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de incrustación de script (XSS) en cabeceras HTTP en versiones 9.3.x de McAfee Network Data Loss Prevention (NDLP) que permite que usuarios autenticados remotos visualicen información confidencial mediante un ataque Cross-Site Request Forgery (CSRF)."
    }
  ],
  "lastModified": "2026-06-17T01:19:10.280",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:network_data_loss_prevention:9.3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C779EE6-F793-4E35-9841-05E99D8AA922"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:network_data_loss_prevention:9.3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45C0C317-D63A-4E89-BF10-6827BB8EB09E"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:network_data_loss_prevention:9.3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "90206971-FBAF-43DF-8EE5-73C8EA9F481A"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:network_data_loss_prevention:9.3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C37E558-1ED5-4F9F-B07A-66D0427A303C"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:network_data_loss_prevention:9.3.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5CBA2394-C4D3-4970-8E38-99034B5A3F32"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@intel.com"
}