CVE-2020-7337

published 2020-12-09

CVE-2020-7337: Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to…

Priority P4 28 medium 6.7 CVSS 3.1

AV L AC L PR H UI N S U C H I H A H

Incorrect Permission Assignment for Critical Resource vulnerability in McAfee VirusScan Enterprise (VSE) prior to 8.8 Patch 16 allows local administrators to bypass local security protection through VSE not correctly integrating with Windows Defender Application Control via careful manipulation of the Code Integrity checks.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
mcafee	virusscan_enterprise	< 8.8	8.8
mcafee	virusscan_enterprise	—	—
mcafee_llc	virusscan_enterprise	8.8.x – patch 15	—

CVSS provenance

nvd v3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 4.6 MEDIUM AV:L/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-732