TI-2020-05902 Aliases CVE-2020-7297 GHSA-2q3v-57hj-r275

Web Gateway (MWG) - Privilege Escalation vulnerability

LOW 26CWE-287Published 2020-09-15 · Updated 2024-08-04

Key facts

Attack vector: Adjacent network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to access protected dashboard data via improper access control in the user interface.

Why it matters now

EPSS 0.00432 37th percentileScored 2026-11-07

Fix Fixed McAfee Web Gateway (MWG) (McAfee): 9.2.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
McAfee	McAfee Web Gateway (MWG)	before 9.2.1	9.2.1	Patch available	CNA

McAfee Web Gateway (MWG) VendorMcAfee Affected before 9.2.1 Fixed in 9.2.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mcafee:web_gateway::::::::	7.8.0 to before 7.8.2.22; 8.2.0 to before 8.2.9; 9.0.0 to before 9.2.1	Vulnerable	McAfee

cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* Versions 7.8.0 to before 7.8.2.22; 8.2.0 to before 8.2.9; 9.0.0 to before 9.2.1 Vulnerable ·McAfee

Remediation

Fix · CNA McAfee Web Gateway (MWG) (McAfee) Fixed in 9.2.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2020-09-15
McAfee Web Gateway (MWG) 9.2.1
5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW
Other records, highest priority first
- TI-2020-05898 Web Gateway (MWG) - Privilege Escalation vulnerabilityPriority MEDIUM 40
- TI-2020-05901 Web Gateway (MWG) - Privilege Escalation vulnerabilityPriority LOW 26
- TI-2020-05900 Web Gateway (MWG) - Privilege Escalation vulnerabilityPriority LOW 22
Show all 5 records →

Timeline

2026-10-02 Threatist record created from CVE-2020-7297
2026-10-03 Alias added: GHSA-2q3v-57hj-r275

References

Other 1

https://kc.mcafee.com/corporate/index?page=content&id=SB10323

TI-2021-02242 Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer… KEVCVSS 3.1HIGH 7.8
TI-2019-06950 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a… CVSS 3.1HIGH 7.5
TI-2019-06949 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a… CVSS 3.1HIGH 7.5
TI-2019-06948 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a… CVSS 3.1HIGH 7.5
TI-2021-02413 NULL pointer deref in signature_algorithms processing CVSS 3.1MEDIUM 5.9
TI-2019-06946 Some HTTP/2 implementations are vulnerable to window size manipulation and stream… CVSS 3.1HIGH 7.5

See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences