CVE-2020-7266: mcafee virusscan_enterprise
Vulnerability summary
CVE-2020-7266 is a high (CVSS 8.8) vulnerability in mcafee virusscan_enterprise. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.4% of scored vulnerabilities.
Timeline
- 08-05-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.4HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:HDiffers
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
0.00 pp
From 0.26% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-274Improper Handling of Insufficient PrivilegesThe product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Mcafee1 product
- virusscan_enterprise≥ 1.9.0, < 1.9.2 | ≥ 2.0.0, < 2.0.3
Mcafee,llc1 product
- mcafee virusscan enterprise (vse) for windows≥ 8.8.x, < 8.8 Patch 14 Hotfix 116778
2 vendors · 2 products
References
1 links- kc.mcafee.com/corporate/index?page=content&id=SB10316X Refsource CONFIRM