CVE-2020-7308

15.04.2021, 08:15

Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence (GTI) servers using DNS allows a remote attacker to view the requests from ENS and responses from GTI over DNS. By gaining control of an intermediate DNS server or altering the network DNS configuration, it is possible for an attacker to intercept requests and send their own responses.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	4.8 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
trellix	CNA	4.8 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 27%

Vendor	Product	Version
mcafee	endpoint_security	𝑥 ≤ 10.6.1
mcafee	endpoint_security	10.6.1
mcafee	endpoint_security	10.6.1:april_2020
mcafee	endpoint_security	10.6.1:december_2018
mcafee	endpoint_security	10.6.1:december_2019
mcafee	endpoint_security	10.6.1:february_2019
mcafee	endpoint_security	10.6.1:february_2020
mcafee	endpoint_security	10.6.1:july_2019
mcafee	endpoint_security	10.6.1:july_2020
mcafee	endpoint_security	10.6.1:may_2019
mcafee	endpoint_security	10.6.1:november_2018
mcafee	endpoint_security	10.6.1:november_2020
mcafee	endpoint_security	10.6.1:october_2019
mcafee	endpoint_security	10.6.1:september_2020
mcafee	endpoint_security	10.7.0:february_2020
mcafee	endpoint_security	10.7.0:july_2020
mcafee	endpoint_security	10.7.0:november_2020
mcafee	endpoint_security	10.7.0:september_2020

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-319 - Cleartext Transmission of Sensitive Information
The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10354