High severity · published May 15, 2019
CVE-2019-3586
Protection Mechanism Failure in the Firewall in McAfee Endpoint Security (ENS) 10.x prior to 10.6.1 May 2019 update allows context-dependent attackers to circumvent ENS protection…
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Protection Mechanism Failure in the Firewall in McAfee Endpoint Security (ENS) 10.x prior to 10.6.1 May 2019 update allows context-dependent attackers to circumvent ENS protection where GTI flagged IP addresses are not blocked by the ENS Firewall via specially crafted malicious sites where the GTI reputation is carefully manipulated and does not correctly trigger the ENS Firewall to block the connection.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Endpoint Security · Mcafee
10.0.0 through 10.6.1; 10.6.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3586
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3586
www.securityfocus.com
http://www.securityfocus.com/bid/108416
kc.mcafee.com
https://kc.mcafee.com/corporate/index?page=content&id=SB10280
More from Endpoint Security
8.8
CVE-2020-7332
Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows an attacker to execute…
8.8
CVE-2020-7319
Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local users to access files which the user…
8.4
CVE-2020-7265
Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Mac prior to 10.6.9 allows local users to delete files the user would otherwise not have access to via…
8.4
CVE-2020-7264
Privilege Escalation vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 Hotfix 199847 allows local users to delete files the user would otherwise not have…
7.8
CVE-2021-31843
Improper privileges management vulnerability in McAfee Endpoint Security (ENS) Windows prior to 10.7.0 September 2021 Update allows local users to access files which they would…