« Volver al listado

CVE-2020-7305

Estado: ModificadaMedia (6.5)—

Privilege escalation vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows a low privileged remote attacker to create new rule sets via incorrect validation of user credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mcafee — Data Loss Prevention

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-7305",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "trellixpsirt@trellix.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "trellixpsirt@trellix.com",
      "affectedData": [
        {
          "vendor": "McAfee",
          "product": "DLP ePO extension",
          "versions": [
            {
              "status": "affected",
              "version": "11.3",
              "lessThan": "11.3.28",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11.4",
              "lessThan": "11.4.200",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11.5",
              "lessThan": "11.5.3",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-08-13T03:15:14.820",
  "references": [
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10326",
      "source": "trellixpsirt@trellix.com"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10326",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "trellixpsirt@trellix.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Privilege escalation vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows a low privileged remote attacker to create new rule sets via incorrect validation of user credentials."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de escalada de privilegios en la extensión ePO de McAfee Data Loss Prevention (DLP) versiones anteriores a 11.5.3, permite a un atacante remoto con poco privilegiado crear nuevos conjuntos de reglas por medio una comprobación incorrecta de las credenciales del usuario"
    }
  ],
  "lastModified": "2026-06-17T03:24:41.330",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5549CA0D-E484-41B3-9FBF-5A9E48DB3668",
              "versionEndExcluding": "11.3.28",
              "versionStartIncluding": "11.3.0"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C387BBB4-FD6A-40EB-B02A-297E45291EF1",
              "versionEndExcluding": "11.4.200",
              "versionStartIncluding": "11.4.0"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D292F8EF-8232-4803-A465-18C6CCBB6DEB",
              "versionEndExcluding": "11.5.3",
              "versionStartIncluding": "11.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "trellixpsirt@trellix.com"
}