PT-2020-19557 · Mcafee · Mcafee Mvision Endpoint

Published 2020-11-11 · Updated 2023-11-16 · CVE-2020-7328

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions McAfee MVISION Endpoint versions prior to 20.11

Description The issue allows remote attackers to gain control of a resource or trigger arbitrary code execution via improper input validation of an HTTP request. This can occur when the content for the attack has been loaded into ePO by an ePO administrator.

Recommendations For versions prior to 20.11, update to version 20.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the ePO extension to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-7328

Affected Products

Mcafee Mvision Endpoint

References · 4

• https://kc.mcafee.com/corporate/index?page=content&id=SB10334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7328 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7328 · Vendor Advisory
• https://t.me/cibsecurity/16150 · Telegram Post