CVE-2020-7337 : Incorrect Permission Assignment for Critical Resource vulnerability in McAfee Vi

Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to bypass local security protection through VSE not correctly integrating with Windows Defender Application Control via careful manipulation of the Code Integrity checks.

Published 2020-12-09 09:15:13

Updated 2020-12-10 19:41:54

Source McAfee (DEFUNCT)

View at NVD, CVE.org

Products affected by CVE-2020-7337

Mcafee » Virusscan Enterprise
Versions before (<) 8.8
cpe:2.3:a:mcafee:virusscan_enterprise:*:*:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:-:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch1
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch1:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch10
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch10:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch11
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch11:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch12
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch12:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch13
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch13:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch14
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch14:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch15
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch15:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch2
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch2:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch3
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch3:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch4
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch4:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch5
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch5:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch6
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch6:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch7
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch7:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch8
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch8:*:*:*:*:*:*
Matching versions
Mcafee » Virusscan Enterprise » Version: 8.8 Update Patch9
cpe:2.3:a:mcafee:virusscan_enterprise:8.8:patch9:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-7337

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 13 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-7337

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
6.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H	0.6	5.9	McAfee (DEFUNCT)
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-7337

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by: psirt@mcafee.com (Primary)

References for CVE-2020-7337

https://kc.mcafee.com/corporate/index?page=content&id=SB10338

Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-7337

Products affected by CVE-2020-7337

Exploit prediction scoring system (EPSS) score for CVE-2020-7337

CVSS scores for CVE-2020-7337

CWE ids for CVE-2020-7337

References for CVE-2020-7337