CVE-2019-3665: Code Injection vulnerability

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-03 · updated 2026-06-17
Weakness: CWE-94

Description

Code Injection vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to render a website which Web Advisor would normally have blocked via a carefully crafted web site.

Affected products

McAfee, LLC McAfee Web Advisor (WA): before 4.1.1.48 — fixed in 4.1.1.48

How to fix

Upgrade to a fixed version: McAfee, LLC McAfee Web Advisor (WA) 4.1.1.48. Check the vendor advisory for mitigations.

References

http://service.mcafee.com/FAQDocument.aspx?&id=TS102991
http://service.mcafee.com/FAQDocument.aspx?&id=TS102991

Get alerted when CVE-2019-3665 or the next vulnerability affects your stack