CVE-2017-4052

CRITICAL

McAfee Advanced Threat Defense 3.4-3.10 - Authentication Bypass via HTTP Request

Title source: llm

Description

Authentication Bypass vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users / remote attackers to change or update any configuration settings, or gain administrator functionality via a crafted HTTP request parameter.

References (2)

Core 2

Core References

Patch, Vendor Advisory x_refsource_confirm

https://kc.mcafee.com/corporate/index?page=content&id=SB10204

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/99557

Scores

CVSS v3 9.8

EPSS 0.0040

EPSS Percentile 60.5%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-306

Status published

Products (8)

McAfee/Advanced Threat Defense (ATD) 3.10

McAfee/Advanced Threat Defense (ATD) 3.4

McAfee/Advanced Threat Defense (ATD) 3.6

McAfee/Advanced Threat Defense (ATD) 3.8

mcafee/advanced_threat_defense 3.4

mcafee/advanced_threat_defense 3.6

mcafee/advanced_threat_defense 3.8

mcafee/advanced_threat_defense 3.10

Published Jul 12, 2017

Tracked Since Feb 18, 2026