CVE-2019-3629

Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://kc.mcafee.com/corporate/index?page=content&id=SB10284

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mcafee:enterprise_security_manager::::::::
	cpe:2.3:a:mcafee:enterprise_security_manager::::::::

History

07 Nov 2023, 03:10

Type	Values Removed	Values Added
References	~~(CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10284 - Broken Link, Vendor Advisory~~	() https://kc.mcafee.com/corporate/index?page=content&id=SB10284 -

04 Mar 2023, 01:46

Type	Values Removed	Values Added
References	~~(CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10284 - Vendor Advisory~~	(CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10284 - Broken Link, Vendor Advisory

Information

Published : 2019-06-27 21:15

Updated : 2023-12-10 12:59

NVD link : CVE-2019-3629

Mitre link : CVE-2019-3629

CVE.ORG link : CVE-2019-3629

JSON object : View

Products Affected

mcafee

enterprise_security_manager

CWE

NVD-CWE-noinfo

{"id": "CVE-2019-3629", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "trellixpsirt@trellix.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2019-06-27T21:15:10.403", "references": [{"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10284", "source": "trellixpsirt@trellix.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters."}, {"lang": "es", "value": "La vulnerabilidad de omisi\u00f3n de la protecci\u00f3n de aplicaciones en McAfee Enterprise Security Manager (ESM) anterior a la 11.2.0 y anterior a la 10.4.0 permite a los usuarios no identificados hacerse pasar por usuarios del sistema a trav\u00e9s de par\u00e1metros especialmente dise\u00f1ados."}], "lastModified": "2023-11-07T03:10:02.570", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:enterprise_security_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7E05BFFB-218A-4B91-880F-F7F321485153", "versionEndExcluding": "10.4.0"}, {"criteria": "cpe:2.3:a:mcafee:enterprise_security_manager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5995933D-6186-46E1-9835-1760CEA6389D", "versionEndExcluding": "11.2.0", "versionStartIncluding": "11.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "trellixpsirt@trellix.com"}