PT-2020-19500 · Mcafee · Dxl Framework

Published 2020-02-17 · Updated 2020-02-28 · CVE-2020-7252

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions McAfee Data eXchange Layer (DXL) Framework versions 6.0.0 and earlier

Description The issue allows local users to cause a denial of service and execute malicious files via carefully crafted and named executable files, due to an unquoted service executable path in DXL Broker.

Recommendations For McAfee Data eXchange Layer (DXL) Framework versions 6.0.0 and earlier, update to a version later than 6.0.0 to resolve the issue.

Fix

Weakness Enumeration

CWE-250

CWE-428

Related Identifiers

CVE-2020-7252

Affected Products

Dxl Framework

References · 4

• https://osv.dev/vulnerability/CVE-2020-7252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7252 · Security Note
• https://t.me/cvenotify/1075 · Telegram Post
• https://kc.mcafee.com/corporate/index?page=content&id=SB10307 · Note