CVE-2020-7250: ENS symbolic link log file manipulation vulnerability
Symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update allows authenticated local user to potentially gain an escalation of privileges by pointing the link to files which the user which not normally have permission to alter via carefully creating symbolic links from the ENS log file directory.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-7250?
CVE-2020-7250 is a symbolic link manipulation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2020 Update that allows an authenticated local user to potentially gain an escalation of privileges.
How does the symbolic link manipulation vulnerability in McAfee Endpoint Security work?
The vulnerability allows an authenticated local user to gain escalated privileges by pointing symbolic links to files they do not normally have permission to alter.
Which version of McAfee Endpoint Security is affected by CVE-2020-7250?
McAfee Endpoint Security versions 10.5.0 to 10.6.0 for Windows are affected by CVE-2020-7250.
What is the severity of CVE-2020-7250?
CVE-2020-7250 has a severity rating of 7.8 (high).
How can I fix the symbolic link manipulation vulnerability in McAfee Endpoint Security?
To fix the vulnerability, update McAfee Endpoint Security to version 10.7.0 February 2020 Update or later.