title:  Endpoint Security for Linux Threat Prevention (ENSLTP) privilege escalation vulnerability
description: An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escalation to delete arbitrary files.
problem types: Race Condition Enabling Link Following (CWE-363)
affected:
{
platforms: x86
product:  Endpoint Security for Linux Threat Prevention (ENSLTP)
vendor: McAfee
versions:
status: affected, version: 10.5.0
status: affected, version: 10.5.1 10.5.0
lessThanOrEqual: 10.2.3 Hotfix 1246778, status: affected, version: 10.2.3 Hotfix 1246778, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L
version: 3.0
]