CVE-2019-3635 MWG Proxy: Cross-Frame Scripting vulnerability

MediumCVSS 6.5 EPSS 1.2%

Published: 2019-08-14 19:18
Updated: 2026-06-17 05:35
Exploit status: No public exploit known

Description

Exfiltration of Data in McAfee Web Gateway (MWG) 7.8.2.x prior to 7.8.2.12 allows attackers to obtain sensitive data via crafting a complex webpage that will trigger the Web Gateway to block the user accessing an iframe.

Affected products

Product	Affected versions	Fixed in
mcafee web gateway	>= 7.8.2.0, < 7.8.2.12	7.8.2.12
McAfee Web Gateway (MWG)	>= 7.8.2.x, < 7.8.2.12	7.8.2.12

References

kc.mcafee.com

CVSS v3.1

6.5 Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

All scores (4)

v3.1 6.5 · nvd@nist.gov
v3.0 4.3 · trellix
v3.0 4.3 · trellixpsirt@trellix.com
v2.0 4.3 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.18% (percentile 68.2)
CWE: Not classified

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.