CVE-2021-23882: Improper Access Control in the ENS installer
First published: Wed Feb 10 2021(Updated: )
Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update allows local administrators to prevent the installation of some ENS files by placing carefully crafted files where ENS will be installed. This is only applicable to clean installations of ENS as the Access Control rules will prevent modification prior to up an upgrade.
Credit: psirt@mcafee.com trellixpsirt@trellix.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mcafee Endpoint Security | <10.7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this McAfee Endpoint Security vulnerability?
The vulnerability ID for this McAfee Endpoint Security vulnerability is CVE-2021-23882.
What is the severity level of CVE-2021-23882?
The severity level of CVE-2021-23882 is high with a severity value of 4.4.
What is the description of CVE-2021-23882?
CVE-2021-23882 is an Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to version 10.7.0.
Which version of McAfee Endpoint Security is affected by this vulnerability?
This vulnerability affects McAfee Endpoint Security for Windows versions prior to 10.7.0.
How can local administrators exploit this vulnerability?
Local administrators can prevent the installation of some ENS files by placing carefully crafted files where ENS will be installed.
- collector/nvd-index
- collector/nvd-api
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/title
- agent/last-modified-date
- agent/weakness
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/mcafee
- canonical/mcafee endpoint security