CVE-2020-7266: Privilege Escalation vulnerability through symbolic links in VSE for Windows
Privilege Escalation vulnerability in McAfee VirusScan Enterprise (VSE) for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a malicious script or program on the target machine.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this McAfee VirusScan Enterprise (VSE) vulnerability?
The vulnerability ID is CVE-2020-7266.
What is the severity of CVE-2020-7266?
The severity of CVE-2020-7266 is high with a CVSS score of 8.4.
How does this vulnerability in McAfee VirusScan Enterprise (VSE) allow privilege escalation?
The vulnerability allows local users to delete files they would otherwise not have access to by manipulating symbolic links.
Which versions of McAfee VirusScan Enterprise (VSE) for Linux are affected by this vulnerability?
Versions 1.9.0 to 1.9.2 and versions 2.0.0 to 2.0.3 of McAfee VirusScan Enterprise for Linux are affected.
How can I fix this vulnerability in McAfee VirusScan Enterprise (VSE)?
To fix this vulnerability, update to McAfee VirusScan Enterprise for Windows 8.8 Patch 14 Hotfix 116778 or later.