Read the docs
TI-2021-06238 Aliases CVE-2021-23884GHSA-66g2-w3xc-xqx7

Clear text exposure of password in McAfee CSR ePO extension

Priority LOW 19CWE-319Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

Cleartext Transmission of Sensitive Information vulnerability in the ePO Extension of McAfee Content Security Reporter (CSR) prior to 2.8.0 allows an ePO administrator to view the unencrypted password of the McAfee Web Gateway (MWG) or the password of the McAfee Web Gateway Cloud Server (MWGCS) read only user used to retrieve log files for analysis in CSR.

Why it matters now

EPSS 0.00221 12th percentileScored 2026-11-07
Fix Fixed McAfee Content Security Reporter (CSR) (McAfee,LLC): 2.8.0CWE-319: Cleartext Transmission of Sensitive Information

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Content Security Reporter (CSR)before 2.8.0CWE-319: Cleartext Transmission of Sensitive Information2.8.0CWE-319: Cleartext Transmission of Sensitive InformationPatch availableCNA
  • McAfee Content Security Reporter (CSR) VendorMcAfee Affected before 2.8.0CWE-319: Cleartext Transmission of Sensitive Information Fixed in 2.8.0CWE-319: Cleartext Transmission of Sensitive Information Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:content_security_reporter:*:*:*:*:*:*:*:*before 2.8.0VulnerableMcAfee
  • cpe:2.3:a:mcafee:content_security_reporter:*:*:*:*:*:*:*:* Versions before 2.8.0 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Content Security Reporter (CSR) (McAfee,LLC) Fixed in 2.8.0CWE-319: Cleartext Transmission of Sensitive Information

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-23884
  2. 2026-10-03 Alias added: GHSA-66g2-w3xc-xqx7

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences