CVE-2020-7255: mcafee, llc mcafee endpoint security (ens)

Vulnerability summary

CVE-2020-7255 is a medium (CVSS 4.4) vulnerability in mcafee, llc mcafee endpoint security (ens). EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 13.2% of scored vulnerabilities.

Timeline

1. 15-04-2020
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Privilege escalation vulnerability in the administrative user interface in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows local users to gain elevated privileges via ENS not checking user permissions when editing configuration in the ENS client interface. Administrators can lock the ENS client interface through ePO to prevent users being able to edit the configuration.

• CWE-264Permissions, Privileges, and Access ControlsWeaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.