Vulnerability · Published Apr 15, 2021 · Assigned by trellix

CVE-2020-7270Sensitive Information Exposure in McAfee ATD

Medium 4.9

In plain English

A medium-severity information exposure in McAfee Advanced Threat Defense (ATD) from McAfee,LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.9%top 41.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Exposure of Sensitive Information in the web interface in McAfee Advanced Threat Defense (ATD) prior to 4.12.2 allows remote authenticated users to view sensitive unencrypted information via a carefully crafted HTTP request parameter. The risk is partially mitigated if your ATD instances are deployed as recommended with no direct access from the Internet to them.

Affected products (as reported)

Vendor	Product	Versions
McAfee,LLC	McAfee Advanced Threat Defense (ATD)	unspecified – before 4.12.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10336 x_refsource_MISC