Lucene search

[email protected]CVE-2020-7308

HistoryApr 15, 2021 - 8:15 a.m.

CVE-2020-7308

2021-04-1508:15:14

CWE-319

[email protected]

web.nvd.nist.gov

cve-2020-7308

cleartext transmission

sensitive information

mcafee

ens

windows

security vulnerability

dns

remote attack

vulnerability

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.8%

JSON

Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence (GTI) servers using DNS allows a remote attacker to view the requests from ENS and responses from GTI over DNS. By gaining control of an intermediate DNS server or altering the network DNS configuration, it is possible for an attacker to intercept requests and send their own responses.

Affected configurations

NVD

Node

mcafeeendpoint_securityRange≤10.6.1windows

mcafeeendpoint_securityMatch10.6.1-windows

mcafeeendpoint_securityMatch10.6.1april_2020windows

mcafeeendpoint_securityMatch10.6.1december_2018windows

mcafeeendpoint_securityMatch10.6.1december_2019windows

mcafeeendpoint_securityMatch10.6.1february_2019windows

mcafeeendpoint_securityMatch10.6.1february_2020windows

mcafeeendpoint_securityMatch10.6.1july_2019windows

mcafeeendpoint_securityMatch10.6.1july_2020windows

mcafeeendpoint_securityMatch10.6.1may_2019windows

mcafeeendpoint_securityMatch10.6.1november_2018windows

mcafeeendpoint_securityMatch10.6.1november_2020windows

mcafeeendpoint_securityMatch10.6.1october_2019windows

mcafeeendpoint_securityMatch10.6.1september_2020windows

mcafeeendpoint_securityMatch10.7.0february_2020windows

mcafeeendpoint_securityMatch10.7.0july_2020windows

mcafeeendpoint_securityMatch10.7.0november_2020windows

mcafeeendpoint_securityMatch10.7.0september_2020windows

CPENameOperatorVersion
mcafee:endpoint_securitymcafee endpoint securityle10.6.1
mcafee:endpoint_securitymcafee endpoint securityeq10.7.0

CPE	Name	Operator	Version
mcafee:endpoint_security	mcafee endpoint security	le	10.6.1
mcafee:endpoint_security	mcafee endpoint security	eq	10.7.0

CNA Affected

[
  {
    "product": "McAfee Endpoint Security (ENS) for WIndows",
    "vendor": "McAfee,LLC",
    "versions": [
      {
        "lessThan": "10.7.0 February 2021 Update",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

kc.mcafee.com/corporate/index?page=content&id=SB10354

Social References

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.8%

JSON

Related for CVE-2020-7308

prion1 cvelist1 nvd1