CVE-2020-7250: fallo de gravedad alta en McAfee Endpoint Security (ENS)
ENS symbolic link log file manipulation vulnerability
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.4%
Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Productos afectados
McAfee LLC · McAfee Endpoint Security (ENS)CVEs relacionadas — McAfee Endpoint Security (ENS)
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-7278HIGHMcAfee firewall rules not enforced correctlyEPSS 0.6%CVE-2020-7275MEDIUMUnquoted service paths for some McAfee ENS filesEPSS 0.3%CVE-2020-7276MEDIUMUnrestricted Policy Management using MfeUpgradeTool.exeEPSS 0.3%CVE-2020-7277MEDIUMMcAfee processes not protectedEPSS 0.3%CVE-2020-7261MEDIUMBuffer overwrite in ENS allowed to bypass AMSI protectionEPSS 0.3%CVE-2020-7257HIGHPrivilege Escalation vulnerability through Symbolic links in ENSEPSS 0.3%