Lucene search

MitreCVE-2022-37025

HistoryAug 18, 2022 - 1:15 p.m.

CVE-2022-37025

2022-08-1813:15:08

CWE-269

mitre

web.nvd.nist.gov

cve-2022-37025

improper privilege management

vulnerability

mcafee security scan plus

mss+

lolbin

living off the land

nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elevated permissions and being able to execute arbitrary code due to lack of an integrity check of the configuration file.

Affected configurations

Nvd

Node

mcafeesecurity_scan_plusRange<4.1.262.1

VendorProductVersionCPE
mcafeesecurity_scan_plus*cpe:2.3:a:mcafee:security_scan_plus:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mcafee	security_scan_plus	*	cpe:2.3:a:mcafee:security_scan_plus::::::::

References

attack.mitre.org/techniques/T1218/

www.mcafee.com/en-us/antivirus/mcafee-security-scan-plus.html

www.mcafee.com/support/?articleId=TS103335&page=shell&shell=article-view

Social References

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-37025