CVE-2020-7284

Exposure of Sensitive Information in McAfee Network Security Management (NSM) prior to 10.1.7.7 allows local users to gain unauthorised access to the root account via execution of carefully crafted commands from the restricted command line interface (CLI).

CVSS v3 8.6 HIGH
CVSS v2.0 7.2 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://kc.mcafee.com/corporate/index?page=content&id=SB10322
https://kc.mcafee.com/corporate/index?page=content&id=SB10322

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mcafee:network_security_management::::::::
	cpe:2.3:a:mcafee:network_security_management::::::::

History

21 Nov 2024, 05:36

Type	Values Removed	Values Added
CVSS	v2 : ~~7.2~~ v3 : ~~7.8~~	v2 : 7.2 v3 : 8.6
References	~~() https://kc.mcafee.com/corporate/index?page=content&id=SB10322 -~~	() https://kc.mcafee.com/corporate/index?page=content&id=SB10322 -

07 Nov 2023, 03:25

Type	Values Removed	Values Added
References	~~(MISC) https://kc.mcafee.com/corporate/index?page=content&id=SB10322 - Vendor Advisory~~	() https://kc.mcafee.com/corporate/index?page=content&id=SB10322 -

Information

Published : 2020-07-03 19:15

Updated : 2024-11-21 05:36

NVD link : CVE-2020-7284

Mitre link : CVE-2020-7284

CVE.ORG link : CVE-2020-7284

JSON object : View

Products Affected

mcafee

network_security_management

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2020-7284", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "trellixpsirt@trellix.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-07-03T19:15:10.623", "references": [{"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10322", "source": "trellixpsirt@trellix.com"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10322", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "trellixpsirt@trellix.com", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Exposure of Sensitive Information in McAfee Network Security Management (NSM) prior to 10.1.7.7 allows local users to gain unauthorised access to the root account via execution of carefully crafted commands from the restricted command line interface (CLI)."}, {"lang": "es", "value": "Una exposici\u00f3n de informaci\u00f3n confidencial en McAfee Network Security Management (NSM) versiones anteriores a 10.1.7.7, permite a usuarios locales conseguir acceso no autorizado a la cuenta root mediante la ejecuci\u00f3n de comandos cuidadosamente dise\u00f1ados desde la interfaz de l\u00ednea de comandos (CLI) restringida"}], "lastModified": "2024-11-21T05:36:59.290", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:network_security_management:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D494C16E-EC29-4191-8D44-F04B2C54F44C", "versionEndExcluding": "9.2.9.55", "versionStartIncluding": "9.0"}, {"criteria": "cpe:2.3:a:mcafee:network_security_management:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F2E496C-D7FB-4BD5-A88C-D307A00F60D8", "versionEndExcluding": "10.1.7.7", "versionStartIncluding": "10.0"}], "operator": "OR"}]}], "sourceIdentifier": "trellixpsirt@trellix.com"}