How severe is CVE-2017-4012?

CVE-2017-4012 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2017-4012 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-4012?

CVE-2017-4012 affects Mcafee Network Data Loss Prevention. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2017-4012?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-4012 published?

CVE-2017-4012 was published on 2017-05-17 and last updated on 2026-06-17.

CVE-2017-4012

CVE-2017-4012 is a medium-severity vulnerability in Mcafee Network Data Loss Prevention with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 5.0
EPSS exploit prediction: 1% (66th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Mcafee Network Data Loss Prevention
Published: 2017-05-17
Last modified: 2026-06-17

Description

Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via modification of the HTTP request.

Frequently asked questions

What is CVE-2017-4012?: Privilege Escalation vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via modification of the HTTP request.
How severe is CVE-2017-4012?: CVE-2017-4012 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2017-4012 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (66th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-4012?: CVE-2017-4012 affects Mcafee Network Data Loss Prevention. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-4012?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-4012 published?: CVE-2017-4012 was published on 2017-05-17 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:mcafee:network_data_loss_prevention:*:*:*:*:*:*:*:*

More vulnerabilities in Mcafee Network Data Loss Prevention

CVE-2017-4014 — High (CVSS 8.0): Session Side jacking vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote…
CVE-2017-3968 — High (CVSS 7.5): Session fixation vulnerability in the web interface in McAfee Network Security Manager (NSM) before 8.2.7.42.2 and…
CVE-2017-3935 — High (CVSS 7.5): Network Data Loss Prevention is vulnerable to MIME type sniffing which allows older versions of Internet Explorer to…
CVE-2014-8533 — High (CVSS 7.5): McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to execute arbitrary code via vectors…
CVE-2014-8530 — High (CVSS 7.5): Unspecified vulnerability in McAfee Network Data Loss Prevention (NDLP) before 9.3 allows remote attackers to obtain…
CVE-2014-8522 — High (CVSS 7.5): The MySQL database in McAfee Network Data Loss Prevention (NDLP) before 9.3 does not require a password, which makes it…

All CVEs affecting Mcafee Network Data Loss Prevention →