{"api_version":"1","generated_at":"2026-07-23T12:18:04+00:00","cve":"CVE-2020-7295","urls":{"html":"https://cve.report/CVE-2020-7295","api":"https://cve.report/api/cve/CVE-2020-7295.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-7295","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-7295"},"summary":{"title":"CVE-2020-7295","description":"Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface.","state":"PUBLIC","assigner":"psirt@mcafee.com","published_at":"2020-09-15 23:15:00","updated_at":"2023-11-07 03:25:00"},"problem_types":["CWE-287"],"metrics":[],"references":[{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10323","name":"N/A","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"McAfee Security Bulletin - Web Gateway update fixes six vulnerabilities (CVE-2020-7292, CVE-2020-7293, CVE-2020-7294, CVE-2020-7295, CVE-2020-7296, and CVE-2020-7297)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7295","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7295","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"7295","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mcafee","cpe5":"web_gateway","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"7295","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mcafee","cpe5":"web_gateway","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"psirt@mcafee.com","ID":"CVE-2020-7295","STATE":"PUBLIC","TITLE":"Web Gateway (MWG) - Privilege Escalation vulnerability"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"McAfee Web Gateway (MWG)","version":{"version_data":[{"version_affected":"<","version_value":"9.2.1"}]}}]},"vendor_name":"McAfee"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface."}]},"generator":{"engine":"Vulnogram 0.0.9"},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":3.5,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-287: Improper Authentication"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10323","name":"https://kc.mcafee.com/corporate/index?page=content&id=SB10323"}]},"source":{"advisory":"SB10323","discovery":"EXTERNAL"}},"nvd":{"publishedDate":"2020-09-15 23:15:00","lastModifiedDate":"2023-11-07 03:25:00","problem_types":["CWE-287"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.1,"impactScore":2.5},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:A/AC:L/Au:S/C:P/I:P/A:N","accessVector":"ADJACENT_NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.1},"severity":"MEDIUM","exploitabilityScore":5.1,"impactScore":4.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"7.8.0","versionEndExcluding":"7.8.2.23","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"8.2.0","versionEndExcluding":"8.2.11","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.2.3","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"7295","Ordinal":"167574","Title":"CVE-2020-7295","CVE":"CVE-2020-7295","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"7295","Ordinal":"1","NoteData":"Privilege Escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.1 allows authenticated user interface user to delete or download protected log data via improper access controls in the user interface.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"7295","Ordinal":"2","NoteData":"2020-09-15","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"7295","Ordinal":"3","NoteData":"2020-09-15","Type":"Other","Title":"Modified"}]}}}