Unscored severity · published Apr 28, 2012
CVE-2012-2212
McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header
–
CVSS
1.4%
EPSS
No
On KEV
Description
McAfee Web Gateway 7.0 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher did not provide configuration details for the vulnerable system, and the observed behavior might be consistent with a configuration that was (perhaps inadvertently) designed to allow access based on Host HTTP headers
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WG
Web Gateway · Mcafee
7.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2212
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2012-04/0118.html
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2012-04/0164.html
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2012-04/0189.html
More from Web Gateway
7.8
CVE-2021-3156
Sudo Heap-Based Buffer Overflow Vulnerability
9.8
CVE-2019-9169
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression…
9.8
CVE-2018-18311
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations
9.8
CVE-2016-4448
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors
9.6
CVE-2019-3638
Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway (MWG) 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive…