CVE-2017-3897
McAfee Security Scan Plus - Remote Command Execution
Severity Score
9.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfee Security Scan Plus (MSS+) versions prior to 3.11.599.3 allows network attackers to perform a malicious file execution via a HTTP backend-response.
Una vulnerabilidad de inyección de código en el mecanismo de autenticación no basado en certificados en McAfee Live Safe en versiones anteriores a la 16.0.3 y McAfee Security Scan Plus (MSS+) en versiones anteriores a la 3.11.599.3 permite que los atacantes en red lleven a cabo la ejecución de un archivo malicioso mediante una respuesta backend HTTP.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-12-26 CVE Reserved
- 2017-07-30 First Exploit
- 2017-09-01 CVE Published
- 2024-04-03 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/100100 | Third Party Advisory |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/44067 | 2017-07-30 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://service.mcafee.com/FAQDocument.aspx?lc=1033&id=TS102723 | 2017-09-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mcafee Search vendor "Mcafee" | Livesafe Search vendor "Mcafee" for product "Livesafe" | <= 16.0.2 Search vendor "Mcafee" for product "Livesafe" and version " <= 16.0.2" | - |
Affected
| ||||||
| Mcafee Search vendor "Mcafee" | Security Scan Plus Search vendor "Mcafee" for product "Security Scan Plus" | <= 3.11.599.2 Search vendor "Mcafee" for product "Security Scan Plus" and version " <= 3.11.599.2" | - |
Affected
| ||||||