Medium severity · published Nov 13, 2019
CVE-2019-3641
Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify…
4.5
CVSS
0.7%
EPSS
No
On KEV
Description
Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TI
Threat Intelligence Exchange Server · Mcafee
3.0.0 · source: NVD
Affected product
TI
Threat Intelligence Exchange Server
Mcafee
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3641
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3641
kc.mcafee.com
https://kc.mcafee.com/corporate/index?page=content&id=SB10303
More from Threat Intelligence Exchange Server
6.5
CVE-2019-3738
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability
5.9
CVE-2019-1559
0-byte record padding oracle
5.9
CVE-2018-6695
SSH host keys generation vulnerability in the server in McAfee Threat Intelligence Exchange Server (TIE Server) 1.3.0, 2.0.x, 2.1.x, 2.2.0 allows man-in-the-middle attackers to…
5.3
CVE-2020-2830
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Concurrency)
5.3
CVE-2020-2781
Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: JSSE)