« Volver al listado

CVE-2020-7307

Estado: ModificadaMedia (5.2)—

Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mcafee — Data Loss Prevention

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-7307",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "trellixpsirt@trellix.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.2,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.2,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "trellixpsirt@trellix.com",
      "affectedData": [
        {
          "vendor": "McAfee",
          "product": "Data Loss Prevention(DLP)",
          "versions": [
            {
              "status": "affected",
              "version": "11.3",
              "lessThan": "11.3.31",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11.4",
              "lessThan": "11.4.200",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "11.5",
              "lessThan": "11.5.2",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-08-13T04:15:13.337",
  "references": [
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10326",
      "source": "trellixpsirt@trellix.com"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10326",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "trellixpsirt@trellix.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Almacenamiento de Credenciales Desprotegido en McAfee Data Loss Prevention (DLP) para Mac versiones anteriores a 11.5.2, permite a usuarios locales conseguir acceso al nombre de usuario y contraseña de RiskDB por medio de archivos de registro no protegidos que contienen credenciales de texto plano"
    }
  ],
  "lastModified": "2026-06-17T03:24:41.547",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5549CA0D-E484-41B3-9FBF-5A9E48DB3668",
              "versionEndExcluding": "11.3.28",
              "versionStartIncluding": "11.3.0"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C387BBB4-FD6A-40EB-B02A-297E45291EF1",
              "versionEndExcluding": "11.4.200",
              "versionStartIncluding": "11.4.0"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D292F8EF-8232-4803-A465-18C6CCBB6DEB",
              "versionEndExcluding": "11.5.3",
              "versionStartIncluding": "11.5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "trellixpsirt@trellix.com"
}