CVE-2021-23878: mcafee llc endpoint security (ens) for windows

Vulnerability summary

CVE-2021-23878 is a high (CVSS 7.3) vulnerability in mcafee llc endpoint security (ens) for windows. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.4% of scored vulnerabilities.

Timeline

1. 10-02-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Clear text storage of sensitive Information in memory vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows a local user to view ENS settings and credentials via accessing process memory after the ENS administrator has performed specific actions. To exploit this, the local user has to access the relevant memory location immediately after an ENS administrator has made a configuration change through the console on their machine

• CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.