Lucene search

[email protected]CVE-2020-7276

HistoryApr 15, 2020 - 12:15 p.m.

CVE-2020-7276

2020-04-1512:15:12

CWE-287

[email protected]

web.nvd.nist.gov

cve

2020

7276

authentication bypass

mfeupgradetool

mcafee

endpoint security

ens

windows

vulnerability

policy settings

administrator

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.6%

JSON

Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows administrator users to access policy settings via running this tool.

Affected configurations

NVD

Node

mcafeeendpoint_securityMatch10.5.0windows

mcafeeendpoint_securityMatch10.5.1windows

mcafeeendpoint_securityMatch10.5.2windows

mcafeeendpoint_securityMatch10.5.3windows

mcafeeendpoint_securityMatch10.5.4windows

mcafeeendpoint_securityMatch10.5.5windows

mcafeeendpoint_securityMatch10.6.0windows

CPENameOperatorVersion
mcafee:endpoint_securitymcafee endpoint securityeq10.5.0
mcafee:endpoint_securitymcafee endpoint securityeq10.5.1
mcafee:endpoint_securitymcafee endpoint securityeq10.5.2
mcafee:endpoint_securitymcafee endpoint securityeq10.5.3
mcafee:endpoint_securitymcafee endpoint securityeq10.5.4
mcafee:endpoint_securitymcafee endpoint securityeq10.5.5
mcafee:endpoint_securitymcafee endpoint securityeq10.6.0

CPE	Name	Operator	Version
mcafee:endpoint_security	mcafee endpoint security	eq	10.5.0
mcafee:endpoint_security	mcafee endpoint security	eq	10.5.1
mcafee:endpoint_security	mcafee endpoint security	eq	10.5.2
mcafee:endpoint_security	mcafee endpoint security	eq	10.5.3
mcafee:endpoint_security	mcafee endpoint security	eq	10.5.4
mcafee:endpoint_security	mcafee endpoint security	eq	10.5.5
mcafee:endpoint_security	mcafee endpoint security	eq	10.6.0

CNA Affected

[
  {
    "product": "McAfee Endpoint Security (ENS)",
    "vendor": "McAfee LLC",
    "versions": [
      {
        "lessThan": "10.7.0 April 2020 Update",
        "status": "affected",
        "version": "10.x",
        "versionType": "custom"
      }
    ]
  }
]

References

kc.mcafee.com/corporate/index?page=content&id=SB10309

4.6 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

6.7 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.6%

JSON

Related for CVE-2020-7276

cvelist1 nvd1 prion1 nessus1