CVE-2020-7332: Cross-Site Request Forgery (CSRF) in firewall ePO extension of McAfee Endpoint Security (ENS)

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-12 · updated 2026-06-17
Weakness: CWE-352

Description

Cross Site Request Forgery vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows an attacker to execute arbitrary HTML code due to incorrect security configuration.

Affected products

McAfee LLC McAfee Endpoint Security (ENS): before 10.6.1 — fixed in 10.6.1

How to fix

Upgrade to a fixed version: McAfee LLC McAfee Endpoint Security (ENS) 10.6.1. Check the vendor advisory for mitigations.

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10335
https://kc.mcafee.com/corporate/index?page=content&id=SB10335

Get alerted when CVE-2020-7332 or the next vulnerability affects your stack