CVE-2022-0166: falha de alta gravidade em McAfee Agent for Windows
Privilege escalation vulnerability in McAfee Agent
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 2.9%
A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR variable as a subdirectory within the installation directory. A low privilege user could have created subdirectories and executed arbitrary code with SYSTEM privileges by creating the appropriate pathway to the specifically created malicious openssl.cnf file.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
McAfee,LLC · McAfee Agent for WindowsCVEs relacionadas — McAfee Agent for Windows
No mesmo produto, das mais perigosas para as menos.
CVE-2021-31854HIGHCode injection vulnerability in McAfee AgentEPSS 1.0%CVE-2021-31847HIGHImproper privilege management in repair process of MA for WindowsEPSS 0.4%CVE-2021-31840HIGHDLL preload vulnerability in McAfee Agent for WindowsEPSS 0.3%CVE-2022-1256HIGHImproper Privilege Management in McAfee Agent for WindowsEPSS 0.3%CVE-2021-31841HIGHDLL side loading vulnerability in MA for WindowsEPSS 0.2%CVE-2021-31836MEDIUMImproper Privilege Management in MA for WindowsEPSS 0.2%