PT-2020-19503 · Mcafee · Mcafee Endpoint Security (Ens) For Windows+1

Published 2020-04-15 · Updated 2020-04-21 · CVE-2020-7255

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions McAfee Endpoint Security (ENS) for Windows versions prior to 10.7.0 February 2020 Update

Description A privilege escalation issue exists in the administrative user interface of McAfee Endpoint Security (ENS) for Windows, where the system fails to check user permissions when editing configuration in the ENS client interface, allowing local users to gain elevated privileges. Administrators can mitigate this by locking the ENS client interface through ePO to prevent users from editing the configuration.

Recommendations For versions prior to 10.7.0 February 2020 Update, administrators can lock the ENS client interface through ePO to prevent users from editing the configuration and gaining elevated privileges.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

CWE-264

Related Identifiers

CVE-2020-7255

Affected Products

Mcafee Endpoint Security (Ens) For Windows

Epo

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-7255 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7255 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10309 · Note
• https://t.me/cvenotify/2765 · Telegram Post