title: Improper Access Control Vulnerability in ENS for Windows
description: Improper Access Control vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local users to access files which the user otherwise would not have access to via manipulating symbolic links to redirect McAfee file operations to an unintended file.
problem types: CWE-59: Improper Link Resolution Before File Access ('Link Following')
affected:
{
product: Endpoint Security for Windows
vendor: McAfee LLC
versions:
lessThan: 10.7.0 September 2020 Update, status: affected, version: 10.7.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]