CVE-2017-3960

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Exploitation of Authorization vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to gain elevated privileges via a crafted HTTP request parameter.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
McAfeeNetwork Security Management (NSM)>= 8, < 8.2.7.42.2

References

Timeline

Published
Jun 12, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-39615.4Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticCVE-2017-39629.8Password recovery exploitation vulnerability in the non-certificate-based authentication mechanism in McAfee Network Security Management (NSCVE-2017-39645.4Reflective Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allowCVE-2017-39658.8Cross-Site Request Forgery (CSRF) (aka Session Riding) vulnerability in the web interface in McAfee Network Security Management (NSM) beforeCVE-2017-39666.3Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security CVE-2017-39676.1Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote CVE-2017-39689.1Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss CVE-2017-39695.9Abuse of communication channels vulnerability in the server in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows man-in-the-CVE-2017-39716.5Cryptanalysis vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to view confCVE-2017-39729.8Infrastructure-based foot printing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows aCVE-2017-39807.2A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, and 5.1.3 and earlier allows remCVE-2017-40116.1Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attacke
CVE-2017-3960: High severity, CVSS 8.8 | Vulnix