CVE-2017-3966: mcafee network security management (nsm) Insufficient Session Expiration

Vulnerability summary

CVE-2017-3966 is a medium (CVSS 6.5) Insufficient Session Expiration vulnerability in mcafee network security management (nsm). EPSS estimates a 0.67% chance of exploitation in the next 30 days, higher than 51.1% of scored vulnerabilities.

Timeline

1. 04-04-2018
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user's browser via reusing the exposed session token in the application URL.

• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."