Medium severity · published Sep 16, 2020
CVE-2020-7297
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access…
5.7
CVSS
0.4%
EPSS
No
On KEV
Description
Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access control in the user interface.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WG
Web Gateway · Mcafee
7.8.0 before 7.8.2.22; 8.2.0 before 8.2.9; 9.0.0 before 9.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7297
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7297
kc.mcafee.com
https://kc.mcafee.com/corporate/index?page=content&id=SB10323
More from Web Gateway
7.8
CVE-2021-3156
Sudo Heap-Based Buffer Overflow Vulnerability
9.8
CVE-2019-9169
In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression…
9.8
CVE-2018-18311
Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations
9.8
CVE-2016-4448
Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors
9.6
CVE-2019-3638
Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway (MWG) 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive…