5.4med
CVE-2017-3907
McAfee Threat Intelligence Exchange (TIE) Server - Code Injection vulnerability
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.4
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known
Summary
Code Injection vulnerability in the ePolicy Orchestrator (ePO) extension in McAfee Threat Intelligence Exchange (TIE) Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector.
Exploit prediction (EPSS)
1.58% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L |
| CNA | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L |
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- McAfee Threat Intelligence Exchange (TIE) Server
Classification
- Weakness
- CWE-94 Improper Control of Generation of Code
References
- kc.mcafee.com /corporate/index?page=content&id=SB10207 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-3907
- NVD: CVE-2017-3907
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.