CVE-2020-7337

Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to bypass local security protection through VSE not correctly integrating with Windows Defender Application Control via careful manipulation of the Code Integrity checks.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
trellixCNA
6.5 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 15%
VendorProductVersion
mcafeevirusscan_enterprise
𝑥
< 8.8
mcafeevirusscan_enterprise
8.8
mcafeevirusscan_enterprise
8.8:patch1
mcafeevirusscan_enterprise
8.8:patch10
mcafeevirusscan_enterprise
8.8:patch11
mcafeevirusscan_enterprise
8.8:patch12
mcafeevirusscan_enterprise
8.8:patch13
mcafeevirusscan_enterprise
8.8:patch14
mcafeevirusscan_enterprise
8.8:patch15
mcafeevirusscan_enterprise
8.8:patch2
mcafeevirusscan_enterprise
8.8:patch3
mcafeevirusscan_enterprise
8.8:patch4
mcafeevirusscan_enterprise
8.8:patch5
mcafeevirusscan_enterprise
8.8:patch6
mcafeevirusscan_enterprise
8.8:patch7
mcafeevirusscan_enterprise
8.8:patch8
mcafeevirusscan_enterprise
8.8:patch9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://kc.mcafee.com/corporate/index?page=content&id=SB10338
https://kc.mcafee.com/corporate/index?page=content&id=SB10338