PT-2020-19558 · Mcafee · Mcafee Mvision Endpoint

Published 2020-11-11 · Updated 2023-11-16 · CVE-2020-7329

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions McAfee MVISION Endpoint versions prior to 20.11

Description A server-side request forgery issue exists, allowing remote attackers to trigger server-side DNS requests to arbitrary domains. This is achieved by loading carefully constructed XML files by an ePO administrator.

Recommendations For versions prior to 20.11, update to version 20.11 or later to resolve the issue. As a temporary workaround, consider restricting the ability to load XML files by ePO administrators until the update is applied.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-7329

Affected Products

Mcafee Mvision Endpoint

References · 3

• https://kc.mcafee.com/corporate/index?page=content&id=SB10334 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7329 · Security Note