CVE-2020-7280

Privilege Escalation vulnerability during daily DAT updates when using McAfee Virus Scan Enterprise (VSE) prior to 8.8 Patch 15 allows local users to cause the deletion and creation of files they would not normally have permission to through altering the target of symbolic links. This is timing dependent.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
trellixCNA
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
VendorProductVersion
mcafeevirusscan_enterprise
8.8
mcafeevirusscan_enterprise
8.8:patch1
mcafeevirusscan_enterprise
8.8:patch10
mcafeevirusscan_enterprise
8.8:patch11
mcafeevirusscan_enterprise
8.8:patch12
mcafeevirusscan_enterprise
8.8:patch13
mcafeevirusscan_enterprise
8.8:patch14
mcafeevirusscan_enterprise
8.8:patch2
mcafeevirusscan_enterprise
8.8:patch3
mcafeevirusscan_enterprise
8.8:patch4
mcafeevirusscan_enterprise
8.8:patch5
mcafeevirusscan_enterprise
8.8:patch6
mcafeevirusscan_enterprise
8.8:patch7
mcafeevirusscan_enterprise
8.8:patch8
mcafeevirusscan_enterprise
8.8:patch9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://kc.mcafee.com/corporate/index?page=content&id=SB10302
https://www.zerodayinitiative.com/advisories/ZDI-20-702/
https://kc.mcafee.com/corporate/index?page=content&id=SB10302
https://www.zerodayinitiative.com/advisories/ZDI-20-702/