CVE-2020-7282: mcafee total_protection Link Following

Vulnerability summary

CVE-2020-7282 is a high (CVSS 7.5) Link Following vulnerability in mcafee total_protection. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.4% of scored vulnerabilities.

Timeline

1. 03-07-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Privilege Escalation vulnerability in McAfee Total Protection (MTP) before 16.0.R26 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.