6.1med
CVE-2017-3967
SB10192 - Network Security Management (NSM) - Target influence via framing vulnerability
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
0.7%
percentile 54%
Public exploits
0
none known
Summary
Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames.
Exploit prediction (EPSS)
0.73% probability of exploitation in the next 30 days, higher than 54% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H |
| CNA | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H |
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- McAfee Network Security Management (NSM)
Classification
- Weakness
- CWE-94 Improper Control of Generation of Code
References
- kc.mcafee.com /corporate/index?page=content&id=SB10192 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-3967
- NVD: CVE-2017-3967
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.