CVE-2020-7250

HIGH

McAfee Endpoint Security for Windows - Authenticated Privilege Escalation via Symbolic Link Manipulation

Title source: llm
STIX 2.1

Description

Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory.

References (1)

Core 1
Core References

Scores

CVSS v3 8.2
EPSS 0.0010
EPSS Percentile 27.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Details

CWE
CWE-59
Status published
Products (7)
mcafee/endpoint_security 10.5.0
mcafee/endpoint_security 10.5.1
mcafee/endpoint_security 10.5.2
mcafee/endpoint_security 10.5.3
mcafee/endpoint_security 10.5.4
mcafee/endpoint_security 10.5.5
mcafee/endpoint_security 10.6.0
Published Apr 15, 2020
Tracked Since Feb 18, 2026