CVE-2022-1824
McAfee MCPR privilege escalation
- State
- Published
- Severity
- 7.9 High
- Published
- Jun 20, 2022
- Updated
- Aug 3, 2024
- Reserved
- May 23, 2022
Description
An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary code as there were insufficient checks on the executable being signed by McAfee.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.9 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H | trellix |
Weaknesses
- CWE-427 Uncontrolled search path element
Affected Products
| Product | Versions |
|---|---|
McAfee Consumer Product Removal ToolMcAfee,LLC |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.