An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elevated permissions and being able to execute arbitrary code due to lack of an integrity check of the configuration file.
References
| Link | Resource |
|---|---|
| https://attack.mitre.org/techniques/T1218/ | Not Applicable |
| https://www.mcafee.com/en-us/antivirus/mcafee-security-scan-plus.html | Product |
| https://www.mcafee.com/support/?articleId=TS103335&page=shell&shell=article-view | Patch Vendor Advisory |
Configurations
History
19 Aug 2022, 15:09
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:mcafee:security_scan_plus:*:*:*:*:*:*:*:* | |
| First Time |
Mcafee security Scan Plus
Mcafee |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CWE | CWE-269 | |
| References | (MISC) https://www.mcafee.com/support/?articleId=TS103335&page=shell&shell=article-view - Patch, Vendor Advisory | |
| References | (MISC) https://attack.mitre.org/techniques/T1218/ - Not Applicable | |
| References | (MISC) https://www.mcafee.com/en-us/antivirus/mcafee-security-scan-plus.html - Product |
18 Aug 2022, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-08-18 13:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-37025
Mitre link : CVE-2022-37025
CVE.ORG link : CVE-2022-37025
JSON object : View
Products Affected
mcafee
- security_scan_plus
CWE
CWE-269
Improper Privilege Management