CVE-2019-3666 API Abuse Vulnerability
Remote attackers can bypass web filtering restrictions in McAfee Web Advisor, allowing users to access blocked websites.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-3666?
CVE-2019-3666 is a medium-severity vulnerability in McAfee, LLC McAfee Web Advisor (WA), published on 3 Dec 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
API Abuse/Misuse vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to navigate to restricted websites via a carefully crafted web site.
Which versions are affected by CVE-2019-3666?
It affects 1 product.
Products include Mcafee Webadvisor.
How do I fix CVE-2019-3666?
No fix has been published for CVE-2019-3666 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3666 being exploited?
There is no known exploitation of CVE-2019-3666 in the wild and no public exploit code.
Other vulnerabilities in McAfee, LLC McAfee Web Advisor (WA)
Sources
Also known as GHSA-mcjf-77cw-j8r2.