CVE-2020-7250: ENS symbolic link log file manipulation vulnerability
First published: Wed Apr 15 2020(Updated: )
Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory.
Credit: psirt@mcafee.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mcafee Endpoint Security | =10.5.0 | |
| Mcafee Endpoint Security | =10.5.1 | |
| Mcafee Endpoint Security | =10.5.2 | |
| Mcafee Endpoint Security | =10.5.3 | |
| Mcafee Endpoint Security | =10.5.4 | |
| Mcafee Endpoint Security | =10.5.5 | |
| Mcafee Endpoint Security | =10.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2020-7250?
CVE-2020-7250 is a symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update that allows an authenticated local user to potentially gain an escalation of privileges.
How does the symbolic link manipulation vulnerability in McAfee Endpoint Security work?
The vulnerability allows an authenticated local user to gain escalated privileges by pointing symbolic links to files they do not normally have permission to alter.
Which version of McAfee Endpoint Security is affected by CVE-2020-7250?
McAfee Endpoint Security versions 10.5.0 to 10.6.0 for Windows are affected by CVE-2020-7250.
What is the severity of CVE-2020-7250?
CVE-2020-7250 has a severity rating of 7.8 (high).
How can I fix the symbolic link manipulation vulnerability in McAfee Endpoint Security?
To fix the vulnerability, update McAfee Endpoint Security to version 10.7.0 February 2020 Update or later.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/mcafee
- canonical/mcafee endpoint security
- version/mcafee endpoint security/10.5.0
- version/mcafee endpoint security/10.5.1
- version/mcafee endpoint security/10.5.2
- version/mcafee endpoint security/10.5.3
- version/mcafee endpoint security/10.5.4
- version/mcafee endpoint security/10.5.5
- version/mcafee endpoint security/10.6.0