title: McAfee Network Security Management (NSM) and Network Data Loss Prevention (NDLP)- Password recovery exploitation vulnerability
description: Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and McAfee Network Data Loss Prevention (NDLP) before 9.3.4.1.5 allows remote attackers to disclose sensitive information or manipulate the database via a crafted authentication cookie.
problem types: Session fixation vulnerability
affected:
{
platforms: x86
product: Network Security Management (NSM)
vendor: McAfee
versions:
lessThan: 8.2.7.42.2, status: affected, version: 8, versionType: custom
}
{
platforms: x86
product: Network Data Loss Prevention (NDLP)
vendor: McAfee
versions:
lessThan: 9.3.4.1.5 Hotfix 1201697_47868, status: affected, version: 9.3, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L
version: 3.0
]