title: ESConfig Tool able to edit configuration for newer version
description: Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security (ENS) Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS.
problem types: CWE-358 Improperly Implemented Security Check for Standard
affected:
{
product: Mcafee Endpoint Security (ENS)
vendor: McAfee, LLC
versions:
lessThan: 10.6.1 February 2020 update, status: affected, version: 10.6.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.1
]