CVE-2021-23884 MEDIUM

CVE-2021-23884: Clear text exposure of password in McAfee CSR ePO extension

Vendor Mcafee,Llc
Product McAfee Content Security Reporter (CSR)
Weakness CWE-319 · Cleartext transmission
Published April 15, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Adjacent
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO administrator to view the unencrypted password of the McAfee Web Gateway (MWG) or the password of the McAfee Web Gateway Cloud Server (MWGCS) read only user used to retrieve log files for analysis in CSR.

Key dates

02Disclosure timeline

April 15, 2021 CVE published
August 3, 2024 Record updated