cvelist/2020/7xxx/CVE-2020-7263.json

{
    "CVE_data_meta": {
        "ASSIGNER": "psirt@mcafee.com",
        "DATE_PUBLIC": "2020-03-31T00:00:00.000Z",
        "ID": "CVE-2020-7263",
        "STATE": "PUBLIC",
        "TITLE": "Attacker can edit the ENS configuration with local administrator permissions"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Endpoint Security (ENS) for Windows",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<=",
                                            "version_name": "10.x",
                                            "version_value": " 10.7.0 February 2020 Update"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name": "McAfee, LLC"
                }
            ]
        }
    },
    "credit": [
        {
            "lang": "eng",
            "value": "McAfee credits Donny Maasland from Fox-IT for reporting this flaw."
        }
    ],
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "Improper access control vulnerability in ESConfigTool.exe in ENS for Windows all current versions allows a local administrator to alter the ENS configuration up to and including disabling all protection offered by ENS via insecurely implemented encryption of configuration for export and import."
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.0.9"
    },
    "impact": {
        "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-264 Permissions, Privileges, and Access Controls"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10314",
                "refsource": "CONFIRM",
                "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10314"
            }
        ]
    },
    "source": {
        "discovery": "EXTERNAL"
    },
    "work_around": [
        {
            "lang": "eng",
            "value": "For ENS installations that ePO manages, you can enable 'Standard access' or 'Lock client Interface' for all your installations centrally. This configuration is done through the Policy Catalog. For ENS installations that ePO does not manage, you can enable 'Standard access' or 'Lock client Interface' through the local control User Interface for each installation. These are detailed out in the security bulletin."
        }
    ]
}