CVE-2019-3666: API Abuse Vulnerability

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-12-03 · updated 2026-06-17

Description

API Abuse/Misuse vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to navigate to restricted websites via a carefully crafted web site.

Affected products

McAfee, LLC McAfee Web Advisor (WA): before 4.1.1.48 — fixed in 4.1.1.48

How to fix

Upgrade to a fixed version: McAfee, LLC McAfee Web Advisor (WA) 4.1.1.48. Check the vendor advisory for mitigations.

References

http://service.mcafee.com/FAQDocument.aspx?&id=TS102991
http://service.mcafee.com/FAQDocument.aspx?&id=TS102991

Get alerted when CVE-2019-3666 or the next vulnerability affects your stack