title: Network Security Management (NSM) - Cross Site Request Forgery vulnerability
description: Cross Site Request Forgery vulnerability in McAfee Network Security Management (NSM) prior to 10.1.7.35 and NSM 9.x prior to 9.2.9.55 may allow an attacker to change the configuration of the Network Security Manager via a carefully crafted HTTP request.
problem types: CWE-352 Cross-Site Request Forgery (CSRF)
affected:
{
product: Network Security Management (NSM)
vendor: McAfee
versions:
lessThan: 10.1.7.35, status: affected, version: NSM 10.x, versionType: custom
lessThan: 9.2.9.55, status: affected, version: NSM 9.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H
version: 3.1
]