Lucene search

TrellixCVE-2022-1823

HistoryJun 20, 2022 - 11:15 a.m.

CVE-2022-1823

2022-06-2011:15:09

CWE-269

trellix

web.nvd.nist.gov

cve-2022-1823

mcafee

vulnerability

privilege management

lolbin

arbitrary code execution

nvd

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.9

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

EPSS

Percentile

5.1%

JSON

Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elevated permissions and being able to execute arbitrary code, through not correctly checking the integrity of the configuration file.

Affected configurations

Nvd

Node

mcafeeconsumer_product_removal_toolRange<10.4.128

VendorProductVersionCPE
mcafeeconsumer_product_removal_tool*cpe:2.3:a:mcafee:consumer_product_removal_tool:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mcafee	consumer_product_removal_tool	*	cpe:2.3:a:mcafee:consumer_product_removal_tool::::::::

CNA Affected

[
  {
    "product": "McAfee Consumer Product Removal Tool",
    "vendor": "McAfee,LLC",
    "versions": [
      {
        "lessThan": "10.4.128",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

service.mcafee.com/?articleId=TS103318&page=shell&shell=article-view

Social References

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.9

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-1823