CVE-2020-7335: mcafee total_protection Improper Privilege Management

Vulnerability summary

CVE-2020-7335 is a high (CVSS 7.8) Improper Privilege Management vulnerability in mcafee total_protection. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 36.2% of scored vulnerabilities.

Timeline

1. 01-12-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Privilege Escalation vulnerability in Microsoft Windows client McAfee Total Protection (MTP) prior to 16.0.29 allows local users to gain elevated privileges via careful manipulation of a folder by creating a junction link. This exploits a lack of protection through a timing issue and is only exploitable in a small time window.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.