207 lines
8.6 KiB
JSON
207 lines
8.6 KiB
JSON
{
|
||
"containers": {
|
||
"cna": {
|
||
"affected": [
|
||
{
|
||
"product": "McAfee Endpoint Security (ENS)",
|
||
"vendor": "McAfee LLC",
|
||
"versions": [
|
||
{
|
||
"lessThan": "10.7.0 April 2020 Update",
|
||
"status": "affected",
|
||
"version": "10.x",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "McAfee credits Jakub Palaczynski (ING Tech Poland) and Eran Shimony (CyberArk) for independently reporting this flaw"
|
||
}
|
||
],
|
||
"datePublic": "2020-04-14T00:00:00.000Z",
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "LOCAL",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 8.2,
|
||
"baseSeverity": "HIGH",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"scope": "CHANGED",
|
||
"userInteraction": "REQUIRED",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
|
||
"version": "3.1"
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"cweId": "CWE-59",
|
||
"description": "CWE-59 Improper Link Resolution Before File Access ('Link Following')",
|
||
"lang": "en",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"providerMetadata": {
|
||
"dateUpdated": "2020-04-15T12:45:14.000Z",
|
||
"orgId": "01626437-bf8f-4d1c-912a-893b5eb04808",
|
||
"shortName": "trellix"
|
||
},
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"x_refsource_CONFIRM"
|
||
],
|
||
"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10309"
|
||
}
|
||
],
|
||
"source": {
|
||
"discovery": "EXTERNAL"
|
||
},
|
||
"title": "ENS symbolic link log file manipulation vulnerability",
|
||
"x_generator": {
|
||
"engine": "Vulnogram 0.0.9"
|
||
},
|
||
"x_legacyV4Record": {
|
||
"CVE_data_meta": {
|
||
"ASSIGNER": "psirt@mcafee.com",
|
||
"DATE_PUBLIC": "2020-04-14T00:00:00.000Z",
|
||
"ID": "CVE-2020-7250",
|
||
"STATE": "PUBLIC",
|
||
"TITLE": "ENS symbolic link log file manipulation vulnerability"
|
||
},
|
||
"affects": {
|
||
"vendor": {
|
||
"vendor_data": [
|
||
{
|
||
"product": {
|
||
"product_data": [
|
||
{
|
||
"product_name": "McAfee Endpoint Security (ENS)",
|
||
"version": {
|
||
"version_data": [
|
||
{
|
||
"version_affected": "<",
|
||
"version_name": "10.x",
|
||
"version_value": "10.7.0 April 2020 Update"
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
},
|
||
"vendor_name": "McAfee LLC"
|
||
}
|
||
]
|
||
}
|
||
},
|
||
"credit": [
|
||
{
|
||
"lang": "eng",
|
||
"value": "McAfee credits Jakub Palaczynski (ING Tech Poland) and Eran Shimony (CyberArk) for independently reporting this flaw"
|
||
}
|
||
],
|
||
"data_format": "MITRE",
|
||
"data_type": "CVE",
|
||
"data_version": "4.0",
|
||
"description": {
|
||
"description_data": [
|
||
{
|
||
"lang": "eng",
|
||
"value": "Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory."
|
||
}
|
||
]
|
||
},
|
||
"generator": {
|
||
"engine": "Vulnogram 0.0.9"
|
||
},
|
||
"impact": {
|
||
"cvss": {
|
||
"attackComplexity": "LOW",
|
||
"attackVector": "LOCAL",
|
||
"availabilityImpact": "HIGH",
|
||
"baseScore": 8.2,
|
||
"baseSeverity": "HIGH",
|
||
"confidentialityImpact": "HIGH",
|
||
"integrityImpact": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"scope": "CHANGED",
|
||
"userInteraction": "REQUIRED",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
|
||
"version": "3.1"
|
||
}
|
||
},
|
||
"problemtype": {
|
||
"problemtype_data": [
|
||
{
|
||
"description": [
|
||
{
|
||
"lang": "eng",
|
||
"value": "CWE-59 Improper Link Resolution Before File Access ('Link Following')"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"references": {
|
||
"reference_data": [
|
||
{
|
||
"name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10309",
|
||
"refsource": "CONFIRM",
|
||
"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10309"
|
||
}
|
||
]
|
||
},
|
||
"source": {
|
||
"discovery": "EXTERNAL"
|
||
}
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-04T09:25:48.498Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"tags": [
|
||
"x_refsource_CONFIRM",
|
||
"x_transferred"
|
||
],
|
||
"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10309"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"cveMetadata": {
|
||
"assignerOrgId": "01626437-bf8f-4d1c-912a-893b5eb04808",
|
||
"assignerShortName": "trellix",
|
||
"cveId": "CVE-2020-7250",
|
||
"datePublished": "2020-04-15T12:45:14.302Z",
|
||
"dateReserved": "2020-01-21T00:00:00.000Z",
|
||
"dateUpdated": "2024-09-16T17:18:05.249Z",
|
||
"state": "PUBLISHED"
|
||
},
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1"
|
||
} |