← Back

CVE-2020-7308

nvd nist
Published: Apr 15, 2021Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Exploitability: 3.9 / Impact: 2.5
Source: NVD

Description

Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence (GTI) servers using DNS allows a remote attacker to view the requests from ENS and responses from GTI over DNS. By gaining control of an intermediate DNS server or altering the network DNS configuration, it is possible for an attacker to intercept requests and send their own responses.

Affected (18)

Mcafee
1 product
Endpoint Security
Configuration A
18 vulnerable
Vulnerable SoftwareAffected Versions
Mcafee
Endpoint Security
Up to 10.6.1
Endpoint Security
Version 10.6.1
Endpoint Security
Version 10.6.1 april_2020
Endpoint Security
Version 10.6.1 december_2018
Endpoint Security
Version 10.6.1 december_2019
Endpoint Security
Version 10.6.1 february_2019
Endpoint Security
Version 10.6.1 february_2020
Endpoint Security
Version 10.6.1 july_2019
Endpoint Security
Version 10.6.1 july_2020
Endpoint Security
Version 10.6.1 may_2019
Endpoint Security
Version 10.6.1 november_2018
Endpoint Security
Version 10.6.1 november_2020
Endpoint Security
Version 10.6.1 october_2019
Endpoint Security
Version 10.6.1 september_2020
Endpoint Security
Version 10.7.0 february_2020
Endpoint Security
Version 10.7.0 july_2020
Endpoint Security
Version 10.7.0 november_2020
Endpoint Security
Version 10.7.0 september_2020

Related CWEs

CWE-319
Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

References (2)

Source: trellixpsirt@trellix.com
Broken LinkVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkVendor Advisory

Timeline

No history available yet.