Read the docs
TI-2020-05931 Aliases CVE-2020-7328GHSA-h485-jr3p-6h83

Server-Side Request Forgery (SSRF) in MVISION Endpoint ePO extension

Priority LOW 36CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

External entity attack vulnerability in the ePO extension in McAfee MVISION Endpoint prior to 20.11 allows remote attackers to gain control of a resource or trigger arbitrary code execution via improper input validation of an HTTP request, where the content for the attack has been loaded into ePO by an ePO administrator.

Why it matters now

EPSS 0.02172 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMVISION Endpoint ePO extension20.x – 20.11—No fix listedCNA
  • MVISION Endpoint ePO extension VendorMcAfee Affected 20.x – 20.11 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:mvision_endpoint:*:*:*:*:*:*:*:*before 20.11VulnerableMcAfee
  • cpe:2.3:a:mcafee:mvision_endpoint:*:*:*:*:*:*:*:* Versions before 20.11 Vulnerable ·McAfee

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7328
  2. 2026-10-03 Alias added: GHSA-h485-jr3p-6h83

References

Advisory 1

  • TI-2020-05932 Server-Side Request Forgery (SSRF) in MVISION Endpoint ePO extension CVSS 3.1HIGH 7.2
  • TI-2020-05928 Privilege Escalation vulnerability in MVISION Endpoint CVSS 3.1HIGH 7.8
  • TI-2020-05890 Privilege Escalation vulnerability in MVISION Endpoint CVSS 3.1HIGH 7.8
  • TI-2019-02648 Improper authentication in McAfee MVision Endpoint CVSS 3.0HIGH 7.4
  • TI-2020-05927 Improper Access Control vulnerability in MVISION Endpoint CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences