CVE-2017-3907
low-risk
Published 2018-06-13
Code Injection vulnerability in the ePolicy Orchestrator (ePO) extension in McAfee Threat Intelligence Exchange (TIE) Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector.
Do I need to act?
-
0.46% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10
Medium
NETWORK
/ HIGH complexity
Affected Products (1)
Mcafee Threat Intelligence Exchange
Affected Vendors
24
/ 100
low-risk
Severity
17/34 · Moderate
Exploitability
2/34 · Minimal
Exposure
5/34 · Minimal