{"containers": {"cna": {"affected": [{"product": "Network Data Loss Prevention", "vendor": "McAfee", "versions": [{"status": "affected", "version": "9.3.X"}]}], "datePublic": "2017-09-14T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack."}], "problemTypes": [{"descriptions": [{"description": "Embedding Script (XSS) in HTTP Headers vulnerability", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-11-01T09:57:01.000Z", "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce", "shortName": "intel"}, "references": [{"name": "101628", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/101628"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10198"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@intel.com", "DATE_PUBLIC": "2017-09-14T00:00:00", "ID": "CVE-2017-3933", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Network Data Loss Prevention", "version": {"version_data": [{"version_value": "9.3.X"}]}}]}, "vendor_name": "McAfee"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Embedding Script (XSS) in HTTP Headers vulnerability"}]}]}, "references": {"reference_data": [{"name": "101628", "refsource": "BID", "url": "http://www.securityfocus.com/bid/101628"}, {"name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10198", "refsource": "CONFIRM", "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10198"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T14:39:41.106Z"}, "title": "CVE Program Container", "references": [{"name": "101628", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/101628"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10198"}]}]}, "cveMetadata": {"assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce", "assignerShortName": "intel", "cveId": "CVE-2017-3933", "datePublished": "2017-10-31T14:00:00.000Z", "dateReserved": "2016-12-26T00:00:00.000Z", "dateUpdated": "2024-09-17T03:22:22.381Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:network_data_loss_prevention:9.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "6C779EE6-F793-4E35-9841-05E99D8AA922", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:network_data_loss_prevention:9.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "45C0C317-D63A-4E89-BF10-6827BB8EB09E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:network_data_loss_prevention:9.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "90206971-FBAF-43DF-8EE5-73C8EA9F481A", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:network_data_loss_prevention:9.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "1C37E558-1ED5-4F9F-B07A-66D0427A303C", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:network_data_loss_prevention:9.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "5CBA2394-C4D3-4970-8E38-99034B5A3F32", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack."}, {"lang": "es", "value": "Existe una vulnerabilidad de incrustaci\u00f3n de script (XSS) en cabeceras HTTP en versiones 9.3.x de McAfee Network Data Loss Prevention (NDLP) que permite que usuarios autenticados remotos visualicen informaci\u00f3n confidencial mediante un ataque Cross-Site Request Forgery (CSRF)."}], "id": "CVE-2017-3933", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-10-31T14:29:00.320", "references": [{"source": "secure@intel.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/101628"}, {"source": "secure@intel.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10198"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/101628"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10198"}], "sourceIdentifier": "secure@intel.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}