CVE-2019-3606 Data leakage when in an MDR pair by McAfee Network Security Manager 9.x
Administrators can view sensitive configuration data in plain text within MDR pairs, exposing secrets to privileged users.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-3606?
CVE-2019-3606 is a high-severity vulnerability in McAfee Network Security Manager (NSM), published on 26 Mar 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Data Leakage Attacks vulnerability in the web portal component when in an MDR pair in McAfee Network Security Management (NSM) 9.1 < 9.1.7.75 (Update 4) and 9.2 < 9.2.7.31 Update2 allows administrators to view configuration information in plain text format via the GUI or GUI terminal commands.
Weakness: CWE-312
Which versions are affected by CVE-2019-3606?
It affects 1 product.
Products include Mcafee Network Security Manager.
How do I fix CVE-2019-3606?
No fix has been published for CVE-2019-3606 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3606 being exploited?
There is no known exploitation of CVE-2019-3606 in the wild and no public exploit code.
Other vulnerabilities in McAfee Network Security Manager (NSM)
- CVE-2017-3965 SB10192 - Network Security Management (NSM) - Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability
- CVE-2017-3972 SB10192 - Network Security Management (NSM) - Infrastructure-based foot printing vulnerability
- CVE-2017-3969 SB10192 - Network Security Management (NSM) - Abuse of communication channels vulnerability
- CVE-2017-3971 SB10192 - Network Security Management (NSM) - Cryptanalysis vulnerability
- CVE-2014-2390 Cross-site request forgery in n/a
Sources
Also known as GHSA-xcf7-vc8w-v2qg.