CWE
79
Advisory Published
Updated

CVE-2021-4038: NSM vulnerable to XSS

First published: Thu Dec 09 2021(Updated: )

Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in all scenarios.

Credit: psirt@mcafee.com trellixpsirt@trellix.com

Affected SoftwareAffected VersionHow to fix
McAfee Network Security Manager<10.1.7.48

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is the severity of CVE-2021-4038?

    The severity of CVE-2021-4038 is medium, with a severity value of 4.8.

  • How does CVE-2021-4038 affect McAfee Network Security Manager?

    CVE-2021-4038 affects McAfee Network Security Manager versions prior to 10.1 Minor 7.

  • How can a remote authenticated administrator exploit CVE-2021-4038?

    A remote authenticated administrator can exploit CVE-2021-4038 by embedding a XSS in the administrator interface via specially crafted custom rules containing HTML.

  • What is the Common Weakness Enumeration (CWE) ID for CVE-2021-4038?

    The Common Weakness Enumeration (CWE) ID for CVE-2021-4038 is 79.

  • How can I fix CVE-2021-4038 in McAfee Network Security Manager?

    To fix CVE-2021-4038 in McAfee Network Security Manager, update to version 10.1 Minor 7 or later.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203