PT-2021-19538 · Mcafee · Mcafee Agent For Windows

Published 2021-09-22 · Updated 2023-11-15 · CVE-2021-31836

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions McAfee Agent for Windows versions prior to 5.7.4

Description The issue is related to improper privilege management in the maconfig utility for McAfee Agent for Windows. This allows a local user to gain access to sensitive information. The utility can be run from any location on the file system and by a low-privileged user.

Recommendations For versions prior to 5.7.4, update to version 5.7.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the maconfig utility to prevent low-privileged users from running it.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-31836

Affected Products

Mcafee Agent For Windows

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-31836 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31836 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10369 · Note
• https://t.me/cibsecurity/29232 · Telegram Post