CVE-2019-3629: Application protections bypass vulnerability could allow unauthenticated user to impersonate system users

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-27 · updated 2026-06-17

Description

Application protection bypass vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows unauthenticated user to impersonate system users via specially crafted parameters.

Affected products

McAfee, LLC McAfee Enterprise Security Manager (ESM): before 10.4.0; from 11.0.0 before 11.2.0 — fixed in 10.4.0, 11.2.0

How to fix

Upgrade to a fixed version: McAfee, LLC McAfee Enterprise Security Manager (ESM) 10.4.0, 11.2.0. Check the vendor advisory for mitigations.

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10284
https://kc.mcafee.com/corporate/index?page=content&id=SB10284

Get alerted when CVE-2019-3629 or the next vulnerability affects your stack