CVE-2024-49592

State: Published
Severity: 6.7 Medium
Published: Nov 15, 2024
Updated: Nov 27, 2024
Reserved: Oct 17, 2024

Description

Trial installer for McAfee Total Protection (legacy trial installer software) 16.0.53 allows local privilege escalation because of an Uncontrolled Search Path Element. The attacker could be "an adversary or knowledgeable user" and the type of attack could be called "DLL-squatting." The issue only affects execution of this installer, and does not leave McAfee Total Protection in a vulnerable state after installation is completed. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-427 Uncontrolled Search Path Element

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://www.mcafee.com/support/s/article/000002516?language=en_US

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.