title: ESConfig Tool access not controlled
description: Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.
problem types: CWE-284 Improper Access Control
affected:
{
product: McAfee Endpoint Security (ENS)
vendor: McAfee, LLC
versions:
lessThan: 10.6.1, status: affected, version: 10.6.x, versionType: custom
lessThan: 10.5.5, status: affected, version: 10.5.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
version: 3.1
]