Vulnerability in Mcafee Endpoint Security
CVE-2020-7308
Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence (GTI) servers using DNS allows a remote attacker to view the requests from ENS and responses from GTI over DNS. By gaining control of an intermediate DNS server or altering the network DNS configuration, it is possible for an attacker to intercept requests and send their own responses.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.005 (41.1th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 41st percentile — 41.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000
Affected products
- Mcafee Endpoint Security — versions 10.6.1, 10.7.0
- Mcafee,llc Mcafee Endpoint Security (Ens) For Windows — versions unspecified
Weakness classification (CWE)
References
- kc.mcafee.com/corporate/index (Broken Link, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-7308?
- CVE-2020-7308 is a medium-severity vulnerability in Mcafee Endpoint Security, classified under Cleartext Transmission of Sensitive Information. CVSS score: 4.8/10. Published 2021-04-15.
- How severe is CVE-2020-7308?
- Medium severity. CVSS v3 base score is 4.8 out of 10.