CVE-2020-7299

Sensitive Data Exposure vulnerability in McAfee True Key Windows Client

Medium5.0EPSS 0.36%

Published: 4 Sept 2020
Updated: 16 Sept 2024
Reserved: 21 Jan 2020
Assigned by: trellix

Description

Cleartext Storage of Sensitive Information in Memory vulnerability in Microsoft Windows client in McAfee True Key (TK) prior to 6.2.109.2 allows a local user logged in with administrative privileges to access to another user’s passwords on the same machine via triggering a process dump in specific situations.

Scores

CVSS scores of CVE-2020-7299, by who scored it
Scored by	CVSS	Score	Vector
trellixCNA (assigner)	3.1	Medium5.0	CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
NVDNVD · Modified	3.1	Medium4.1	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 0.36% · top 70% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.0.

Weakness

CWE-522: Insufficiently Protected Credentials (opens in a new tab)All about CWE-522 and its CVEs

Affected products

McAfee,LLC · McAfee True Key Windows client
- affected 6.x – < 6.2.110.8

References (1)

https://service.mcafee.com/webcenter/portal/oracle/webcenter/page/scopedMD/s55728c97_466d_4ddb_952d_05484ea932c6/Page29.jspx?wc.contextURL=%2Fspaces%2Fcp&articleId=TS103066&_afrLoop=1258314779734827&leftWidth=0%25&showFooter=false&showHeader=false&rightWidth=0%25&centerWidth=100%25 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-7299](https://trackcve.app/badge/CVE-2020-7299.svg)](https://trackcve.app/cve/CVE-2020-7299)

Record last updated 16 Sept 2024, 19:05 UTC.