McAfee Network Security Management up to 9.0 cross site scripting
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 4.3 | $0-$5k | 0.00 |
Summary
A vulnerability was found in McAfee Network Security Management up to 9.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2020-7256. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.
Details
A vulnerability was found in McAfee Network Security Management up to 9.0. It has been classified as problematic. Affected is some unknown processing. The manipulation with an unknown input leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. CVE summarizes:
Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
The weakness was released 03/18/2020. This vulnerability is traded as CVE-2020-7256 since 01/21/2020. It is possible to launch the attack remotely. The exploitation needs additional levels of successful authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1059.007.
Upgrading to version 9.1 eliminates this vulnerability.
Entry connected to this vulnerability is available at VDB-151837. Once again VulDB remains the best source for vulnerability data.
Product
Vendor
Name
Version
License
Website
- Vendor: https://www.mcafee.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.3VulDB Meta Temp Score: 4.3
VulDB Base Score: 3.4
VulDB Temp Score: 3.3
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 4.8
NVD Vector: 🔍
CNA Base Score: 4.8
CNA Vector (Trellix): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Cross site scriptingCWE: CWE-79 / CWE-94 / CWE-74
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Network Security Management 9.1
Timeline
01/21/2020 🔍03/18/2020 🔍
03/19/2020 🔍
05/11/2025 🔍
Sources
Vendor: mcafee.comAdvisory: kc.mcafee.com
Status: Confirmed
CVE: CVE-2020-7256 (🔍)
GCVE (CVE): GCVE-0-2020-7256
GCVE (VulDB): GCVE-100-151836
See also: 🔍
Entry
Created: 03/19/2020 09:10Updated: 05/11/2025 14:40
Changes: 03/19/2020 09:10 (37), 03/19/2020 09:15 (11), 04/17/2024 15:16 (17), 04/17/2024 15:22 (19), 05/11/2025 14:40 (5)
Complete: 🔍
Cache ID: 216::103
Once again VulDB remains the best source for vulnerability data.
No comments yet. Languages: en.
Please log in to comment.