CVE-2019-3650

Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD prior to 4.8 allows remote authenticated attackers to gain access to the atduser credentials via carefully constructed GET request extracting insecurely information stored in the database.

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://kc.mcafee.com/corporate/index?page=content&id=SB10304

Configurations

Configuration 1 (hide)

cpe:2.3:a:mcafee:advanced_threat_defense:*:*:*:*:*:*:*:*

History

07 Nov 2023, 03:10

Type	Values Removed	Values Added
References	~~(MISC) https://kc.mcafee.com/corporate/index?page=content&id=SB10304 - Vendor Advisory~~	() https://kc.mcafee.com/corporate/index?page=content&id=SB10304 -
CWE	~~CWE-200~~	NVD-CWE-noinfo

Information

Published : 2019-11-13 23:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-3650

Mitre link : CVE-2019-3650

CVE.ORG link : CVE-2019-3650

JSON object : View

Products Affected

mcafee

advanced_threat_defense

CWE

NVD-CWE-noinfo

{"id": "CVE-2019-3650", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "trellixpsirt@trellix.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2019-11-13T23:15:11.887", "references": [{"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10304", "source": "trellixpsirt@trellix.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD prior to 4.8 allows remote authenticated attackers to gain access to the atduser credentials via carefully constructed GET request extracting insecurely information stored in the database."}, {"lang": "es", "value": "Una vulnerabilidad de Divulgaci\u00f3n de Informaci\u00f3n en McAfee Advanced Threat Defense (ATD) versiones anteriores a la versi\u00f3n 4.8, permite a atacantes autenticados remotos conseguir acceso a las credenciales de usuario mediante una petici\u00f3n GET cuidadosamente construida extrayendo de forma no segura la informaci\u00f3n almacenada en la base de datos."}], "lastModified": "2023-11-07T03:10:07.330", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:advanced_threat_defense:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CADCFA8-E78F-460F-9753-7B51988E7B19", "versionEndExcluding": "4.8"}], "operator": "OR"}]}], "sourceIdentifier": "trellixpsirt@trellix.com"}