What is the severity of CVE-2017-3948?

CVE-2017-3948 is considered a medium severity vulnerability due to its potential for Cross Site Scripting attacks.

How do I fix CVE-2017-3948?

To fix CVE-2017-3948, update the McAfee Data Loss Prevention Endpoint to a version that has patched the XSS vulnerability.

Who is affected by CVE-2017-3948?

Authenticated users of McAfee Data Loss Prevention Endpoint versions 10.0.x are affected by CVE-2017-3948.

What type of attack does CVE-2017-3948 enable?

CVE-2017-3948 enables Cross Site Scripting (XSS) attacks through injection of malicious JavaScript into a user's session.

Is there a workaround for CVE-2017-3948?

Currently, the best mitigation for CVE-2017-3948 is to apply the available security updates from McAfee.

Vulnerability/
CVE-2017-3948

medium

5.4

CWE

23/6/2017

5/7/2017

CVE-2017-3948: XSS

First published: Fri Jun 23 2017(Updated: )

Cross Site Scripting (XSS) in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x allows authenticated users to inject arbitrary web script or HTML via injecting malicious JavaScript into a user's browsing session.

Credit: secure@intel.com

Affected Software	Affected Version	How to fix
McAfee Data Loss Prevention Endpoint	=10.0
McAfee Data Loss Prevention Endpoint	=10.0.100
McAfee Data Loss Prevention Endpoint	=10.0.200
McAfee Data Loss Prevention Endpoint	=10.0.230
McAfee Data Loss Prevention Endpoint	=10.0.250

Remedy

https://kc.mcafee.com/corporate/index?page=content&id=SB10202

Never miss a vulnerability like this again

Reference Links

https://kc.mcafee.com/corporate/index?page=content&id=SB10202

Frequently Asked Questions

What is the severity of CVE-2017-3948?
CVE-2017-3948 is considered a medium severity vulnerability due to its potential for Cross Site Scripting attacks.
How do I fix CVE-2017-3948?
To fix CVE-2017-3948, update the McAfee Data Loss Prevention Endpoint to a version that has patched the XSS vulnerability.
Who is affected by CVE-2017-3948?
Authenticated users of McAfee Data Loss Prevention Endpoint versions 10.0.x are affected by CVE-2017-3948.
What type of attack does CVE-2017-3948 enable?
CVE-2017-3948 enables Cross Site Scripting (XSS) attacks through injection of malicious JavaScript into a user's session.
Is there a workaround for CVE-2017-3948?
Currently, the best mitigation for CVE-2017-3948 is to apply the available security updates from McAfee.

agent/weakness
agent/type
agent/event
agent/severity
agent/references
agent/author
agent/description
agent/remedy
agent/last-modified-date
agent/first-publish-date
agent/softwarecombine
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/mcafee
canonical/mcafee data loss prevention endpoint
version/mcafee data loss prevention endpoint/10.0
version/mcafee data loss prevention endpoint/10.0.100
version/mcafee data loss prevention endpoint/10.0.200
version/mcafee data loss prevention endpoint/10.0.230
version/mcafee data loss prevention endpoint/10.0.250

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.