CVE-2021-31847CWE-269CWE-347

Improper privilege management in repair process of MA for Windows

High · published September 22, 2021

CVSS v3.1
8.2
EPSS
0%
Percentile
32.9
In the wild
Unconfirmed
What it is

Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and the ability to execute arbitrary code as the system user, through not correctly protecting a temporary directory used in the repair process and not checking the DLL signature.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00399 · 32.9th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-347 · Improper Verification of Cryptographic Signature
Published
2021-09-22T13:25Z
EPSS history
Timeline
  • 22 SEP 13:25Z
    Improper privilege management in repair process of MA for Windows
    cvelistv5