Privilege escalation in Mcafee Virusscan Enterprise
CVE-2020-7280
Privilege Escalation vulnerability during daily DAT updates when using McAfee Virus Scan Enterprise (VSE) prior to 8.8 Patch 15 allows local users to cause the deletion and creation of files they would not normally have permission to through altering the target of symbolic links. This is timing dependent.
Vulnerability class: Privilege Escalation
EPSS: 0.004 (32.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Mcafee Virusscan_enterprise — versions 8.8
- Mcafee, Llc Mcafee Virusscan Enterprise (Vse) — versions 8.8.x
Weakness classification (CWE)
References
- trellixpsirt@trellix.com (x_refsource_CONFIRM)
- trellixpsirt@trellix.com (x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-7280?
- CVE-2020-7280 is a high-severity vulnerability in Mcafee Virusscan Enterprise, classified under Improper Privilege Management. CVSS score: 7.8/10. Published 2020-06-10.
- How severe is CVE-2020-7280?
- High severity. CVSS v3 base score is 7.8 out of 10.