{"id":"CVE-2019-3653","state":"PUBLISHED","title":"ESConfig Tool access not controlled","description":"Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.","publishedAt":"2019-10-09T14:21:45.000Z","updatedAt":"2024-08-04T19:12:09.671Z","severity":{"score":4.6,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","source":"trellix"},"assigner":"trellix","products":["McAfee, LLC McAfee Endpoint Security (ENS)"],"affected":[{"vendor":"McAfee, LLC","product":"McAfee Endpoint Security (ENS)","versions":[{"version":"10.6.x","status":"affected","lessThan":"10.6.1","versionType":"custom"},{"version":"10.5.x","status":"affected","lessThan":"10.5.5","versionType":"custom"}]}],"references":["https://kc.mcafee.com/corporate/index?page=content&id=SB10299"],"weaknesses":["CWE-284"],"ingestedAt":"2026-10-29T19:45:59.128Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2019/3xxx/CVE-2019-3653.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2019-3653","state":"PUBLISHED","datePublished":"2019-10-09T14:21:45.000Z","dateUpdated":"2024-08-04T19:12:09.671Z","assignerShortName":"trellix","assignerOrgId":"01626437-bf8f-4d1c-912a-893b5eb04808","dateReserved":"2019-01-03T00:00:00.000Z"},"containers":{"cna":{"title":"ESConfig Tool access not controlled","descriptions":[{"lang":"en","value":"Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool."}],"affected":[{"vendor":"McAfee, LLC","product":"McAfee Endpoint Security (ENS)","versions":[{"version":"10.6.x","status":"affected","lessThan":"10.6.1","versionType":"custom"},{"version":"10.5.x","status":"affected","lessThan":"10.5.5","versionType":"custom"}]}],"references":[{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10299","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"trellix","dateUpdated":"2019-10-09T14:21:45.000Z","orgId":"01626437-bf8f-4d1c-912a-893b5eb04808"},"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.0.8"},"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@mcafee.com","ID":"CVE-2019-3653","STATE":"PUBLIC","TITLE":"ESConfig Tool access not controlled"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"McAfee Endpoint Security (ENS)","version":{"version_data":[{"version_affected":"<","version_name":"10.6.x","version_value":"10.6.1"},{"version_affected":"<","version_name":"10.5.x","version_value":"10.5.5"}]}}]},"vendor_name":"McAfee, LLC"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool."}]},"generator":{"engine":"Vulnogram 0.0.8"},"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-284 Improper Access Control"}]}]},"references":{"reference_data":[{"name":"https://kc.mcafee.com/corporate/index?page=content&id=SB10299","refsource":"CONFIRM","url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10299"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10299","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-04T19:12:09.671Z"}}]}}}