TI-2019-02694 Aliases CVE-2019-3654 GHSA-qwm5-wg3c-7c8w

Client Proxy (MCP) - Authentication Bypass vulnerability

LOW 38CWE-287Published 2019-11-22 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be generated by the network administrator.

Why it matters now

EPSS 0.00665 52nd percentileScored 2026-11-07

Fix Fixed Client Proxy (MCP) (McAfee): 3.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
McAfee	Client Proxy (MCP)	before 3.0.0	3.0.0	Patch available	CNA

Client Proxy (MCP) VendorMcAfee Affected before 3.0.0 Fixed in 3.0.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:mcafee:client_proxy::::::::	before 3.0.0	Vulnerable	McAfee
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:mcafee:client_proxy:*:*:*:*:*:*:*:* Versions before 3.0.0 Vulnerable ·McAfee
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA Client Proxy (MCP) (McAfee) Fixed in 3.0.0

Timeline

2026-10-02 Threatist record created from CVE-2019-3654
2026-10-03 Alias added: GHSA-qwm5-wg3c-7c8w

References

Other 1

https://kc.mcafee.com/corporate/index?page=content&id=SB10305

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences