PT-2022-2271 · Mcafee · Mcafee Web Advisor

Published 2022-03-07 · Updated 2022-05-10 · CVE-2022-0815

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions McAfee WebAdvisor versions up to 8.1.0.1895

Description The issue is related to improper access control in the McAfee WebAdvisor Chrome and Edge browser extensions. This could allow a remote attacker to gain access to McAfee WebAdvisor settings and other details about the user’s system, leading to unexpected behaviors such as settings being changed, fingerprinting of the system, and targeted scams. The attacker could also prevent malicious software from being detected if McAfee software is present.

Recommendations For versions up to 8.1.0.1895, update to a version later than 8.1.0.1895 to resolve the issue. At the moment, there is no information about other specific mitigation measures for this vulnerability.

Fix

Improper Access Control

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-284

CWE-668

Related Identifiers

BDU:2022-02381

CVE-2022-0815

Affected Products

Mcafee Web Advisor

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-0815 · Security Note
• https://bdu.fstec.ru/vul/2022-02381 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0815 · Vendor Advisory
• https://t.me/cvenotify/28071 · Telegram Post
• https://service.mcafee.com/?articleId=TS103273&page=shell&shell=article-view · Note
• https://t.me/cibsecurity/38754 · Telegram Post
• https://service.mcafee.com/?articleId=TS103273&page=shell&shell=article-view · Note