CVE-2017-3898: mcafee live safe Improper Input Validation

Vulnerability summary

CVE-2017-3898 is a medium (CVSS 5.9) Improper Input Validation vulnerability in mcafee live safe. EPSS estimates a 3.18% chance of exploitation in the next 30 days, higher than 87.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-09-2017
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

A man-in-the-middle attack vulnerability in the non-certificate-based authentication mechanism in McAfee LiveSafe (MLS) versions prior to 16.0.3 allows network attackers to modify the Windows registry value associated with the McAfee update via the HTTP backend-response.

• CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.