title: Unrestricted Policy Management using MfeUpgradeTool.exe
description: Authentication bypass vulnerability in MfeUpgradeTool in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 April 2020 Update allows administrator users to access policy settings via running this tool.
problem types: CWE-287 Improper Authentication
affected:
{
product: McAfee Endpoint Security (ENS)
vendor: McAfee LLC
versions:
lessThan: 10.7.0 April 2020 Update, status: affected, version: 10.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:L
version: 3.1
]