McAfee Vulnerability Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
BID:64795
Info
McAfee Vulnerability Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
| Bugtraq ID: | 64795 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 09 2014 12:00AM |
| Updated: | Jan 09 2014 12:00AM |
| Credit: | Nuri Fattah, COMPUSEC Branch, NATO INFOSEC Technical Centre |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
McAfee Vulnerability Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
McAfee Vulnerability Manager is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.
An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions in the context of the affected application. Other attacks are also possible.
McAfee Vulnerability Manager 7.5.5, 7.5.4 and 7.0.11 are vulnerable.
McAfee Vulnerability Manager is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.
An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions in the context of the affected application. Other attacks are also possible.
McAfee Vulnerability Manager 7.5.5, 7.5.4 and 7.0.11 are vulnerable.
Exploit / POC
McAfee Vulnerability Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.
An attacker must trick an unsuspecting victim into following a malicious URI to exploit these issues.
Solution / Fix
McAfee Vulnerability Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
McAfee Vulnerability Manager Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
References:
References: