CVE-2009-5117

The Web Post Protection feature in McAfee Host Data Loss Prevention (DLP) 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web traffic by reading unspecified files.

CVSS v2.0 1.9 LOW

1.9^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/78447
https://kc.mcafee.com/corporate/index?page=content&id=SB10011	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/78447
https://kc.mcafee.com/corporate/index?page=content&id=SB10011	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mcafee:host_data_loss_prevention:3.0.100.6:::::::*
	cpe:2.3:a:mcafee:host_data_loss_prevention:9.0.0.416:::::::*

History

21 Nov 2024, 01:11

Type	Values Removed	Values Added
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/78447 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/78447 -
References	~~() https://kc.mcafee.com/corporate/index?page=content&id=SB10011 - Vendor Advisory~~	() https://kc.mcafee.com/corporate/index?page=content&id=SB10011 - Vendor Advisory

Information

Published : 2012-08-22 10:42

Updated : 2024-11-21 01:11

NVD link : CVE-2009-5117

Mitre link : CVE-2009-5117

CVE.ORG link : CVE-2009-5117

JSON object : View

Products Affected

mcafee

host_data_loss_prevention

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2009-5117", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-08-22T10:42:03.647", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78447", "source": "cve@mitre.org"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10011", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78447", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10011", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "The Web Post Protection feature in McAfee Host Data Loss Prevention (DLP) 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web traffic by reading unspecified files."}, {"lang": "es", "value": "La funcionalidad Web Post Protection en McAfee Host Data Loss Prevention (DLP) v3.x anteriores a v3.0.100.10 y v9.x anteriores a v9.0.0.422, cunado el modo HTTP Capture est\u00e1 activado, permite a usuarios locales a obtener informaci\u00f3n sensible del tr\u00e1fico web leyendo ficheros no especificados."}], "lastModified": "2024-11-21T01:11:12.623", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:host_data_loss_prevention:3.0.100.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D694D73D-B5A2-4A38-AA9E-4A464947CA81"}, {"criteria": "cpe:2.3:a:mcafee:host_data_loss_prevention:9.0.0.416:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE267883-1753-47AB-8750-2BFC3151ADC2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}