CVE-2017-3897: mcafee live safe Code Injection

Vulnerability summary

CVE-2017-3897 is a critical (CVSS 9.8) Code Injection vulnerability in mcafee live safe. EPSS estimates a 11.68% chance of exploitation in the next 30 days, higher than 96% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-09-2017
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

A Code Injection vulnerability in the non-certificate-based authentication mechanism in McAfee Live Safe versions prior to 16.0.3 and McAfee Security Scan Plus (MSS+) versions prior to 3.11.599.3 allows network attackers to perform a malicious file execution via a HTTP backend-response.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.