CVE-2019-3615

Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords via incorrectly auto completing password fields in the admin browser login screen.

CVSS v3 5.3 MEDIUM
CVSS v2.0 2.1 LOW

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability : 1.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/107385
https://kc.mcafee.com/corporate/index?page=content&id=SB10277
http://www.securityfocus.com/bid/107385
https://kc.mcafee.com/corporate/index?page=content&id=SB10277

Configurations

Configuration 1 (hide)

cpe:2.3:a:mcafee:database_security:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:42

Type	Values Removed	Values Added
CVSS	v2 : ~~2.1~~ v3 : ~~6.8~~	v2 : 2.1 v3 : 5.3
References	~~() http://www.securityfocus.com/bid/107385 -~~	() http://www.securityfocus.com/bid/107385 -
References	~~() https://kc.mcafee.com/corporate/index?page=content&id=SB10277 -~~	() https://kc.mcafee.com/corporate/index?page=content&id=SB10277 -

07 Nov 2023, 03:10

Type	Values Removed	Values Added
References	~~(CONFIRM) https://kc.mcafee.com/corporate/index?page=content&id=SB10277 - Patch, Vendor Advisory~~	() https://kc.mcafee.com/corporate/index?page=content&id=SB10277 -
References	~~(BID) http://www.securityfocus.com/bid/107385 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/107385 -

Information

Published : 2019-03-12 21:29

Updated : 2024-11-21 04:42

NVD link : CVE-2019-3615

Mitre link : CVE-2019-3615

CVE.ORG link : CVE-2019-3615

JSON object : View

Products Affected

mcafee

database_security

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2019-3615", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "trellixpsirt@trellix.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "published": "2019-03-12T21:29:00.200", "references": [{"url": "http://www.securityfocus.com/bid/107385", "source": "trellixpsirt@trellix.com"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10277", "source": "trellixpsirt@trellix.com"}, {"url": "http://www.securityfocus.com/bid/107385", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10277", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Data Leakage Attacks vulnerability in the web interface in McAfee Database Security prior to the 4.6.6 March 2019 update allows local users to expose passwords via incorrectly auto completing password fields in the admin browser login screen."}, {"lang": "es", "value": "Una vulnerabilidad de fuga de datos en la interfaz web de McAffee Database Security, en versiones anteriores a la actualizaci\u00f3n 4.6.6 de marzo de 2019, permite a los usuarios locales exponer contrase\u00f1as mediante el autorelleno de campos de contrase\u00f1a incorrecto en la pantalla de inicio de sesi\u00f3n del navegador de administrador."}], "lastModified": "2024-11-21T04:42:15.017", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:database_security:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DE49265-D9C0-4ACE-9EAD-03C3AF5F2F59", "versionEndIncluding": "4.6.6"}], "operator": "OR"}]}], "sourceIdentifier": "trellixpsirt@trellix.com"}