CVE-2021-23884
Assigner: trellix
Published: 2021-04-15T07:30:15
State: PUBLISHED
affected: product: McAfee Content Security Reporter (CSR)
vendor: McAfee,LLC
versions: lessThan: 2.8.0CWE-319: Cleartext Transmission of Sensitive Information
status: affected
version: unspecified
versionType: custom
descriptions: value: Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO administrator to view the unencrypted password of the McAfee Web Gateway (MWG) or the password of the McAfee Web Gateway Cloud Server (MWGCS) read only user used to retrieve log files for analysis in CSR.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information 
type: CWE
source: discovery: EXTERNAL
title: Clear text exposure of password in McAfee CSR ePO extension
x_generator: engine: Vulnogram 0.0.9