Sign-up

ID

VAR-201909-0101


CVE

CVE-2019-3638


TITLE

McAfee Web Gateway Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2019-009340

DESCRIPTION

Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway (MWG) 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive information or execute commands with the MWG administrator's credentials via tricking the administrator to click on a carefully constructed malicious link. McAfee Web Gateway (MWG) Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. The product provides features such as threat protection, application control, and data loss prevention. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code

Trust: 1.8

sources: NVD: CVE-2019-3638 // JVNDB: JVNDB-2019-009340 // VULHUB: VHN-155073 // VULMON: CVE-2019-3638

AFFECTED PRODUCTS

vendor:mcafeemodel:web gatewayscope:ltversion:8.2.0

Trust: 1.0

vendor:mcafeemodel:web gatewayscope:ltversion:7.8.2.13

Trust: 1.0

vendor:mcafeemodel:web gatewayscope:gteversion:7.8.2

Trust: 1.0

vendor:mcafeemodel:web gatewayscope:gteversion:8.0.0

Trust: 1.0

vendor:mcafeemodel:web gateway softwarescope:eqversion:7.8.2.13

Trust: 0.8

vendor:mcafeemodel:web gateway softwarescope:ltversion:7.8.x

Trust: 0.8

sources: JVNDB: JVNDB-2019-009340 // NVD: CVE-2019-3638

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-3638
value: CRITICAL

Trust: 1.0

trellixpsirt@trellix.com: CVE-2019-3638
value: HIGH

Trust: 1.0

NVD: CVE-2019-3638
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201909-569
value: CRITICAL

Trust: 0.6

VULHUB: VHN-155073
value: MEDIUM

Trust: 0.1

VULMON: CVE-2019-3638
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-3638
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-155073
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-3638
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 6.0
version: 3.1

Trust: 1.0

trellixpsirt@trellix.com: CVE-2019-3638
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 5.2
version: 3.1

Trust: 1.0

NVD: CVE-2019-3638
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-155073 // VULMON: CVE-2019-3638 // JVNDB: JVNDB-2019-009340 // CNNVD: CNNVD-201909-569 // NVD: CVE-2019-3638 // NVD: CVE-2019-3638

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

sources: VULHUB: VHN-155073 // JVNDB: JVNDB-2019-009340 // NVD: CVE-2019-3638

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201909-569

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201909-569

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-009340

PATCH
title:SB10294url:https://kc.mcafee.com/corporate/index?page=content&id=SB10294
Trust: 0.8
title:McAfee Web Gateway Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=98152
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-009340 // 
            
            
            
            CNNVD: CNNVD-201909-569

EXTERNAL IDS
db:NVDid:CVE-2019-3638
Trust: 2.6
db:MCAFEEid:SB10294
Trust: 1.8
db:JVNDBid:JVNDB-2019-009340
Trust: 0.8
db:CNNVDid:CNNVD-201909-569
Trust: 0.7
db:AUSCERTid:ESB-2019.3477
Trust: 0.6
db:VULHUBid:VHN-155073
Trust: 0.1
db:VULMONid:CVE-2019-3638
Trust: 0.1
sources:
            
            
            VULHUB: VHN-155073 // 
            
            
            
            VULMON: CVE-2019-3638 // 
            
            
            
            JVNDB: JVNDB-2019-009340 // 
            
            
            
            CNNVD: CNNVD-201909-569 // 
            
            
            
            NVD: CVE-2019-3638

REFERENCES
url:https://kc.mcafee.com/corporate/index?page=content&id=sb10294
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-3638
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-3638
Trust: 0.8
url:https://vigilance.fr/vulnerability/mcafee-web-gateway-cross-site-scripting-via-administrators-web-console-30305
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.3477/
Trust: 0.6
url:https://kc.mcafee.com/corporate/index?page=content&id=sb10294
Trust: 0.1
url:https://cwe.mitre.org/data/definitions/79.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            VULHUB: VHN-155073 // 
            
            
            
            VULMON: CVE-2019-3638 // 
            
            
            
            JVNDB: JVNDB-2019-009340 // 
            
            
            
            CNNVD: CNNVD-201909-569 // 
            
            
            
            NVD: CVE-2019-3638

SOURCES
db:VULHUBid:VHN-155073
db:VULMONid:CVE-2019-3638
db:JVNDBid:JVNDB-2019-009340
db:CNNVDid:CNNVD-201909-569
db:NVDid:CVE-2019-3638

LAST UPDATE DATE
2024-11-23T22:21:31.522000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-155073date:2022-12-13T00:00:00
db:VULMONid:CVE-2019-3638date:2023-11-07T00:00:00
db:JVNDBid:JVNDB-2019-009340date:2019-09-18T00:00:00
db:CNNVDid:CNNVD-201909-569date:2022-12-14T00:00:00
db:NVDid:CVE-2019-3638date:2024-11-21T04:42:16.720

SOURCES RELEASE DATE
db:VULHUBid:VHN-155073date:2019-09-12T00:00:00
db:VULMONid:CVE-2019-3638date:2019-09-12T00:00:00
db:JVNDBid:JVNDB-2019-009340date:2019-09-18T00:00:00
db:CNNVDid:CNNVD-201909-569date:2019-09-11T00:00:00
db:NVDid:CVE-2019-3638date:2019-09-12T16:15:12.037