CVE-2019-3654
Client Proxy (MCP) - Authentication Bypass vulnerability
Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be generated by the network administrator.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Client Proxy (MCP) - Authentication Bypass vulnerability
Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be generated by the network administrator.
- Record
CVE-2019-3654- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2019-13289
Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be generated by the network administrator.
- Record
EUVD-2019-13289- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qwm5-wg3c-7c8w No score
Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP)...
Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be generated by the network administrator.
- Record
GHSA-qwm5-wg3c-7c8w- Updated
- 2026-11-02
NVD
Authentication Bypass vulnerability in the Microsoft Windows client in McAfee Client Proxy (MCP) prior to 3.0.0 allows local user to bypass scanning of web traffic and gain access to blocked sites for a short period of time via generating an authorization key on the client which should only be generated by the network administrator.
- Record
CVE-2019-3654- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:N/A:H - CVSS 3.1
- 8.6 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-3654 is a medium vulnerability (CVSS 5.3) in Mcafee Client Proxy (mcp), published November 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 52nd percentile. No source names a fixed version.