CVE-2020-7337

Published: Dec 9, 2020Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to bypass local security protection through VSE not correctly integrating with Windows Defender Application Control via careful manipulation of the Code Integrity checks.

Affected (17)

Products: Mcafee: Virusscan Enterprise

Mcafee

1 product

Virusscan Enterprise

Configuration A

17 vulnerable

Vulnerable Software	Affected Versions
Mcafee Virusscan Enterprise	Before 8.8
Mcafee Virusscan Enterprise	Version 8.8
Mcafee Virusscan Enterprise	Version 8.8 patch10
Mcafee Virusscan Enterprise	Version 8.8 patch11
Mcafee Virusscan Enterprise	Version 8.8 patch12
Mcafee Virusscan Enterprise	Version 8.8 patch13
Mcafee Virusscan Enterprise	Version 8.8 patch14
Mcafee Virusscan Enterprise	Version 8.8 patch15
Mcafee Virusscan Enterprise	Version 8.8 patch1
Mcafee Virusscan Enterprise	Version 8.8 patch2
Mcafee Virusscan Enterprise	Version 8.8 patch3
Mcafee Virusscan Enterprise	Version 8.8 patch4
Mcafee Virusscan Enterprise	Version 8.8 patch5
Mcafee Virusscan Enterprise	Version 8.8 patch6
Mcafee Virusscan Enterprise	Version 8.8 patch7
Mcafee Virusscan Enterprise	Version 8.8 patch8
Mcafee Virusscan Enterprise	Version 8.8 patch9

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (2)

https://kc.mcafee.com/corporate/index?page=content&id=SB10338

Source: trellixpsirt@trellix.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10338

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.