CVE-2019-3648

published 2019-11-13

CVE-2019-3648: A Privilege Escalation vulnerability in the Microsoft Windows client in McAfee Total Protection 16.0.R22 and earlier allows administrators to execute arbitrary…

Priority P4 30 medium 6.7 CVSS 3.1

AV L AC L PR H UI N S U C H I H A H

A Privilege Escalation vulnerability in the Microsoft Windows client in McAfee Total Protection 16.0.R22 and earlier allows administrators to execute arbitrary code via carefully placing malicious files in specific locations protected by administrator permission.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
mcafee	anti-virus_plus	<= 16.0.r22	—
mcafee	internet_security	<= 16.0.r22	—
mcafee	total_protection	<= 16.0r22	—
mcafee_llc	mcafee_total_protection	>= 16.0.x < 16.0.R22 Refresh 1	16.0.R22 Refresh 1

CVSS provenance

nvd v3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.2 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-426