Vulnerability Details : CVE-2020-7252
Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service and malicious file execution via carefully crafted and named executable files.
Vulnerability category: Denial of service
Products affected by CVE-2020-7252
- cpe:2.3:a:mcafee:data_exchange_layer:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-7252
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 23 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-7252
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
1.9
|
LOW | AV:L/AC:M/Au:N/C:N/I:N/A:P |
3.4
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST | |
|
4.2
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H |
0.6
|
3.6
|
McAfee (DEFUNCT) |
CWE ids for CVE-2020-7252
-
The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.Assigned by: psirt@mcafee.com (Secondary)
-
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-7252
-
https://kc.mcafee.com/corporate/index?page=content&id=SB10307
McAfee Security Bulletin - Data Exchange Layer Broker (Windows) update fixes "Unquoted service executable path" vulnerability (CVE-2020-7252)Vendor Advisory
Jump to