CVE-2020-7266
Privilege Escalation vulnerability through symbolic links in VSE for Windows
- State
- Published
- Severity
- 8.8 High
- Published
- May 8, 2020
- Updated
- Sep 17, 2024
- Reserved
- Jan 21, 2020
Description
Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | trellix |
Weaknesses
- CWE-274 Improper Handling of Insufficient Privileges
Affected Products
| Product | Versions |
|---|---|
McAfee VirusScan Enterprise (VSE) for WindowsMcAfee,LLC |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.