CVE-2019-3639 MWG UI: Cross-Frame Scripting vulnerability
Remote attackers can perform clickjacking attacks on the McAfee Web Gateway admin console due to missing X-Frame-Options headers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-3639?
CVE-2019-3639 is a high-severity vulnerability in McAfee, LLC McAfee Web Gateway (MWG), published on 14 Aug 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Clickjack vulnerability in Adminstrator web console in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows remote attackers to conduct clickjacking attacks via a crafted web page that contains an iframe via does not send an X-Frame-Options HTTP header.
Weakness: CWE-1021
Which versions are affected by CVE-2019-3639?
It affects 1 product.
Products include Mcafee Web Gateway.
How do I fix CVE-2019-3639?
No fix has been published for CVE-2019-3639 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3639 being exploited?
There is no known exploitation of CVE-2019-3639 in the wild and no public exploit code.
Other vulnerabilities in McAfee, LLC McAfee Web Gateway (MWG)
- CVE-2021-23885 Privilege escalation vulnerability in McAfee Web Gateway (MWG) UI
- CVE-2020-7293 Web Gateway (MWG) - Privilege Escalation vulnerability
- CVE-2019-3638 Web Gateway (MWG) - Reflected Cross Site Scripting vulnerability
- CVE-2022-1254 SWG URL redirection vulnerability
- CVE-2020-7296 Web Gateway (MWG) - Privilege Escalation vulnerability
Sources
Also known as GHSA-xc8j-x355-h9cr.