What’s Vulnerable › Vulnerabilities

CVE-2017-3965: SB10192 - Network Security Management (NSM) - Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-04-04 · updated 2026-06-17
• Weakness: CWE-352

Description

Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to perform unauthorized tasks such as retrieving internal system information or manipulating the database via specially crafted URLs.

Affected products

• McAfee Network Security Management (NSM): before 8.2.7.42.2 — fixed in 8.2.7.42.2

How to fix

Upgrade to a fixed version: McAfee Network Security Management (NSM) 8.2.7.42.2. Check the vendor advisory for mitigations.

References

• https://kc.mcafee.com/corporate/index?page=content&id=SB10192
• https://kc.mcafee.com/corporate/index?page=content&id=SB10192

Get alerted when CVE-2017-3965 or the next vulnerability affects your stack