CVE-2020-7328

HIGH

McAfee MVISION Endpoint < 20.11 - Server-Side Request Forgery via ePO Extension HTTP Request

Title source: llm
STIX 2.1

Description

External entity attack vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers to gain control of a resource or trigger arbitrary code execution via improper input validation of an HTTP request, where the content for the attack has been loaded into ePO by an ePO administrator.

References (1)

Core 1
Core References
Broken Link, Vendor Advisory x_refsource_confirm
https://kc.mcafee.com/corporate/index?page=content&id=SB10334

Scores

CVSS v3 7.2
EPSS 0.0146
EPSS Percentile 81.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-918
Status published
Products (1)
mcafee/mvision_endpoint < 20.11
Published Nov 11, 2020
Tracked Since Feb 18, 2026