CVE-2021-23896: Cleartext Transmission of Sensitive Information in McAfee DBSec

Severity: medium (CVSS 4.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-02 · updated 2026-06-17
Weakness: CWE-319

Description

Cleartext Transmission of Sensitive Information vulnerability in the administrator interface of McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to view the unencrypted password of the McAfee Insights Server used to pass data to the Insights Server. This user is restricted to only have access to DBSec data in the Insights Server.

Affected products

McAfee,LLC McAfee Database Security (DBSec): before 4.8.2 — fixed in 4.8.2

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee Database Security (DBSec) 4.8.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-23896 or the next vulnerability affects your stack