CVE-2018-6674

Privilege escalation vulnerability in McAfee VSE when McTray run with elevated privileges

State: Published
Severity: 6.8 Medium
Published: May 25, 2018
Updated: Aug 5, 2024
Reserved: Feb 6, 2018

Description

Privilege Escalation vulnerability in Microsoft Windows client (McTray.exe) in McAfee VirusScan Enterprise (VSE) 8.8 prior to Patch 13 allows local users to spawn unrelated processes with elevated privileges via the system administrator granting McTray.exe elevated privileges (by default it runs with the current user's privileges).

Scores

CVSS	Score	Vector	Source
3.0	6.8 Medium	CVSS:3.0/AV:P/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H	trellix

Weaknesses

CWE-264 Permissions, Privileges, and Access Control (CWE-264)
CWE-274 Privilege Escalation (CWE-274)
CWE-269 Data Leakage via Privilege Escalation (CWE-269)

Affected Products

Product	Versions
VirusScan Enterprise (VSE)McAfee, LLC	8.8 to before 8.8 Patch 13Affected

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10237

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.