Read the docs
TI-2017-02996 Aliases CVE-2017-3907GHSA-xjmv-7wr2-r7c4

McAfee Threat Intelligence Exchange (TIE) Server - Code Injection vulnerability

Priority MEDIUM 45CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-94.

Summary

Code Injection vulnerability in the ePolicy Orchestrator (ePO) extension in McAfee Threat Intelligence Exchange (TIE) Server 2.1.0 and earlier allows remote attackers to execute arbitrary HTML code to be reflected in the response web page via unspecified vector.

Why it matters now

EPSS 0.01578 75th percentileScored 2026-11-07
Fix Fixed Threat Intelligence Exchange (TIE) Server (McAfee): 2.1.0 Hotfix 1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeThreat Intelligence Exchange (TIE) Server2.1.0 to before 2.1.0 Hotfix 12.1.0 Hotfix 1Patch availableCNA
  • Threat Intelligence Exchange (TIE) Server VendorMcAfee Affected 2.1.0 to before 2.1.0 Hotfix 1 Fixed in 2.1.0 Hotfix 1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:mcafee_threat_intelligence_exchange:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableMcAfee
  • cpe:2.3:a:mcafee:mcafee_threat_intelligence_exchange:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·McAfee

Remediation

  • Fix · CNA Threat Intelligence Exchange (TIE) Server (McAfee) Fixed in 2.1.0 Hotfix 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-3907
  2. 2026-10-03 Alias added: GHSA-xjmv-7wr2-r7c4

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences