CVE-2017-4011

published 2017-05-17

CVE-2017-4011: Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get…

Priority P3 37 medium 6.1 CVSS 3.0

AV N AC L PR N UI R S C C L I L A N

EXPLOIT

Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mcafee	network_data_loss_prevention	<= 9.3.0	—
mcafee	network_data_loss_prevention	—	—

CVSS provenance

nvd v3.0 6.1 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79