CVE-2020-7265: mcafee endpoint_security
Vulnerability summary
CVE-2020-7265 is a high (CVSS 8.8) vulnerability in mcafee endpoint_security. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.6% of scored vulnerabilities.
Timeline
- 08-05-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Mac prior to 10.6.9 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.4HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:HDiffers
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
17%
Versus all other CVEs
30-day change
0.00 pp
From 0.26% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-274Improper Handling of Insufficient PrivilegesThe product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Mcafee1 product
- endpoint_security≥ 10.5.0, < 10.6.9
Mcafee,llc1 product
- mcafee endpoint security (ens) for mac≥ 10.6.x, ≤ 10.6.9
2 vendors · 2 products
References
1 links- kc.mcafee.com/corporate/index?page=content&id=SB10316X Refsource CONFIRM