CVE-2022-37025

Published Aug 18, 2022

Last updated 2 years ago

Overview

Description: An improper privilege management vulnerability in McAfee Security Scan Plus (MSS+) before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elevated permissions and being able to execute arbitrary code due to lack of an integrity check of the configuration file.
Source: cve@mitre.org
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-269

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:mcafee:security_scan_plus:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A9CE715F-32EF-476A-AAF5-22F3A6B936F3",
            "versionEndExcluding": "4.1.262.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References