CVE-2017-4052 — Missing Authentication for Critical Function in Advanced Threat Defense

CWE-306 — Missing Authentication for Critical Function3 documents3 sources

Severity

9.8CRITICALNVD

EPSS

0.4%

top 39.60%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mcafee Advanced Threat Defense

Timeline

PublishedJul 12

Latest updateMay 17

Description

Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to change or update any configuration settings, or gain administrator functionality via a crafted HTTP request parameter.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5mcafee/advanced_threat_defense4 versions+3

▶NVDmcafee/advanced_threat_defense4 versions+3

Patches

Patch: kc.mcafee.com ↗Patch: kc.mcafee.com ↗

🔴Vulnerability Details

GHSA

GHSA-gpj7-8w88-vwrg: Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3↗2022-05-17

▶

CVEList

CVE-2017-4052: Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3↗2017-07-12

▶