CVE-2022-1824

Published: Jun 20, 2022Modified: Jun 17, 2026

8.2

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Exploitability: 1.5 / Impact: 6.0

Source: NVD

Description

An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary code as there were insufficient checks on the executable being signed by McAfee.

Affected (1)

Products: Mcafee: Consumer Product Removal Tool

1 product

Consumer Product Removal Tool

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mcafee Consumer Product Removal Tool	Before 10.4.128

Related CWEs

Uncontrolled Search Path Element

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

References (2)

https://service.mcafee.com/?articleId=TS103318&page=shell&shell=article-view

Source: trellixpsirt@trellix.com

Vendor Advisory

https://service.mcafee.com/?articleId=TS103318&page=shell&shell=article-view

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.