Security readout for executives and security teams
Plain-English summary
CVE-2020-7333 is a medium-severity XSS issue in the McAfee Endpoint Security firewall ePO extension before the 10.7.0 November 2020 Update. A high-privilege administrator could place script or HTML through the configuration wizard, potentially affecting another user who views it.
Executive priority
Treat this as a routine but necessary endpoint management update. It is not shown as actively exploited, but it affects a privileged security administration interface, where compromise could erode trust in management workflows.
Technical view
The issue is CWE-79 in the ENS firewall ePO extension. CVSS 3.1 is 4.8: network reachable, low complexity, high privileges required, user interaction required, changed scope, and low confidentiality and integrity impact. Availability impact is not reported.
Likely exposure
Exposure is likely limited to organizations running McAfee Endpoint Security for Windows with the firewall ePO extension at vulnerable 10.7.x levels before the November 2020 update. Risk depends on who has ePO administrative access and who may view affected configuration content.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. Practical abuse requires an administrator-level actor and user interaction, which lowers broad internet risk but still matters in shared administration environments.
Researcher notes
Do not assume unauthenticated exploitation. The CVSS vector requires high privileges and user interaction. Validate exact extension build and advisory applicability before assigning exposure, because the bundle only identifies ENS for Windows 10.7.x and the firewall ePO extension before the November 2020 update.
Mitigation direction
- Review McAfee advisory SB10335 for the vendor-stated fix details.
- Update ENS firewall ePO extension to the 10.7.0 November 2020 Update or later.
- Limit ePO administrative privileges to trusted, necessary users.
- Monitor ePO administration changes for unexpected script or HTML content.
Validation and detection
- Inventory ENS for Windows and firewall ePO extension versions.
- Confirm systems are not running versions before the 10.7.0 November 2020 Update.
- Review ePO administrator role assignments and recent configuration changes.
- Check whether affected configuration wizard content has unexpected HTML or script entries.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-7333 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N1.72.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.8MediumVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://kc.mcafee.com/corporate/index?page=content&id=SB10335CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.