CVE-2021-23879
Medium
Description
Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with higher-level privileges, via execution from a compromised folder. The tool did not enforce and protect the execution path. Local admin privileges are required to place the files in the required location.
SeverityMedium
CVSS6.7
Exploit probability—
ProductMcafee Endpoint Product Removal Tool
PublishedMar 15, 2021
First seenMar 15, 2021
Weakness typeCWE-428CWE-428
How to fix
Update
- mcafee endpoint_product_removal_tool21.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mcafee endpoint_product_removal_tool | v < 21.2 | 21.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.