Read the docs
TI-2020-05913 Aliases CVE-2020-7308GHSA-xhp8-xqff-cr9g

Transmission of data in clear text by McAfee ENS

Priority LOW 29CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.

Summary

Cleartext Transmission of Sensitive Information between McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence (GTI) servers using DNS allows a remote attacker to view the requests from ENS and responses from GTI over DNS. By gaining control of an intermediate DNS server or altering the network DNS configuration, it is possible for an attacker to intercept requests and send their own responses.

Why it matters now

EPSS 0.00528 44th percentileScored 2026-11-07
Fix Fixed McAfee Endpoint Security (ENS) for WIndows (McAfee,LLC): 10.7.0 February 2021 Update

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Endpoint Security (ENS) for WIndowsbefore 10.7.0 February 2021 Update10.7.0 February 2021 UpdatePatch availableCNA
  • McAfee Endpoint Security (ENS) for WIndows VendorMcAfee Affected before 10.7.0 February 2021 Update Fixed in 10.7.0 February 2021 Update Patch available CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:endpoint_security:*:*:*:*:*:windows:*:*up to 10.6.1VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:-:*:*:*:windows:*:*10.6.1VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:april_2020:*:*:*:windows:*:*10.6.1 april_2020VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:december_2018:*:*:*:windows:*:*10.6.1 december_2018VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:december_2019:*:*:*:windows:*:*10.6.1 december_2019VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:february_2019:*:*:*:windows:*:*10.6.1 february_2019VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:february_2020:*:*:*:windows:*:*10.6.1 february_2020VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:july_2019:*:*:*:windows:*:*10.6.1 july_2019VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:july_2020:*:*:*:windows:*:*10.6.1 july_2020VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:may_2019:*:*:*:windows:*:*10.6.1 may_2019VulnerableMcAfee
  • cpe:2.3:a:mcafee:endpoint_security:*:*:*:*:*:windows:*:* Versions up to 10.6.1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:-:*:*:*:windows:*:* Versions 10.6.1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:april_2020:*:*:*:windows:*:* Versions 10.6.1 april_2020 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:december_2018:*:*:*:windows:*:* Versions 10.6.1 december_2018 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:december_2019:*:*:*:windows:*:* Versions 10.6.1 december_2019 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:february_2019:*:*:*:windows:*:* Versions 10.6.1 february_2019 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:february_2020:*:*:*:windows:*:* Versions 10.6.1 february_2020 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:july_2019:*:*:*:windows:*:* Versions 10.6.1 july_2019 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:july_2020:*:*:*:windows:*:* Versions 10.6.1 july_2020 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:may_2019:*:*:*:windows:*:* Versions 10.6.1 may_2019 Vulnerable ·McAfee
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:mcafee:endpoint_security:10.6.1:november_2018:*:*:*:windows:*:*10.6.1 november_2018VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:november_2020:*:*:*:windows:*:*10.6.1 november_2020VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:october_2019:*:*:*:windows:*:*10.6.1 october_2019VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.6.1:september_2020:*:*:*:windows:*:*10.6.1 september_2020VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.7.0:february_2020:*:*:*:windows:*:*10.7.0 february_2020VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.7.0:july_2020:*:*:*:windows:*:*10.7.0 july_2020VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.7.0:november_2020:*:*:*:windows:*:*10.7.0 november_2020VulnerableMcAfee
cpe:2.3:a:mcafee:endpoint_security:10.7.0:september_2020:*:*:*:windows:*:*10.7.0 september_2020VulnerableMcAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:november_2018:*:*:*:windows:*:* Versions 10.6.1 november_2018 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:november_2020:*:*:*:windows:*:* Versions 10.6.1 november_2020 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:october_2019:*:*:*:windows:*:* Versions 10.6.1 october_2019 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.6.1:september_2020:*:*:*:windows:*:* Versions 10.6.1 september_2020 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.7.0:february_2020:*:*:*:windows:*:* Versions 10.7.0 february_2020 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.7.0:july_2020:*:*:*:windows:*:* Versions 10.7.0 july_2020 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.7.0:november_2020:*:*:*:windows:*:* Versions 10.7.0 november_2020 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:endpoint_security:10.7.0:september_2020:*:*:*:windows:*:* Versions 10.7.0 september_2020 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Endpoint Security (ENS) for WIndows (McAfee,LLC) Fixed in 10.7.0 February 2021 Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7308
  2. 2026-10-03 Alias added: GHSA-xhp8-xqff-cr9g

References

Advisory 1

  • TI-2020-05935 Cross-Site Request Forgery (CSRF) in firewall ePO extension of McAfee Endpoint Security (ENS) CVSS 3.1HIGH 8.8
  • TI-2020-05923 Improper Access Control Vulnerability in ENS for Windows CVSS 3.1HIGH 8.8
  • TI-2020-05872 Privilege Escalation vulnerability through symbolic links in ENSM CVSS 3.1HIGH 8.8
  • TI-2020-05871 Privilege Escalation vulnerability through symbolic links in ENS for Windows CVSS 3.1HIGH 8.8
  • TI-2019-02647 McAfee Endpoint Security updates fix a privilege escalation vulnerability CVSS 3.0HIGH 8.6
  • TI-2020-05864 Privilege Escalation vulnerability through Symbolic links in ENS CVSS 3.1HIGH 8.4
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences