PT-2021-15584 · Mcafee · Mcafee Endpoint Security (Ens) For Windows

Published 2021-02-10 · Updated 2023-11-16 · CVE-2021-23882

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: McAfee Endpoint Security (ENS) for Windows versions prior to 10.7.0 February 2021 Update

Description: The issue allows local administrators to prevent the installation of some ENS files by placing carefully crafted files where ENS will be installed. This is only applicable to clean installations of ENS, as the Access Control rules will prevent modification prior to an upgrade.

Recommendations: For McAfee Endpoint Security (ENS) for Windows versions prior to 10.7.0 February 2021 Update, update to version 10.7.0 February 2021 Update or later to resolve the issue. As a temporary workaround, consider restricting access to the installation directory to prevent local administrators from placing malicious files.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-23882

Affected Products

Mcafee Endpoint Security (Ens) For Windows

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-23882 · Security Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10345 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23882 · Vendor Advisory
• https://t.me/cvenotify/9712 · Telegram Post