{"id":"CVE-2019-3653","aliases":["EUVD-2019-13288","GHSA-jcfm-vp6v-gw5w"],"status":"published","title":"ESConfig Tool access not controlled","description":"Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00231,"percentile":0.14075,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2019-10-09T14:21:45Z","modified":"2026-06-17T02:35:21Z","products":[{"vendor":"mcafee","product":"endpoint_security"},{"vendor":"mcafee, llc","product":"mcafee endpoint security (ens)"}],"references":[{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10299","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3653"},{"url":"https://github.com/advisories/GHSA-jcfm-vp6v-gw5w"}],"sources":{"cve":[{"id":"CVE-2019-3653","title":"ESConfig Tool access not controlled","description":"Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.","status":"published","published":"2019-10-09T14:21:45Z","modified":"2024-08-04T19:12:09.671Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13288","description":"Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.","status":"published","published":"2019-10-09T14:21:45Z","modified":"2024-08-04T19:12:09Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:06:54.939848Z"}],"ghsa":[{"id":"GHSA-jcfm-vp6v-gw5w","title":"Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS)...","description":"Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.","status":"published","published":"2022-05-24T16:58:20Z","modified":"2023-01-28T05:07:50Z","updated_at":"2026-11-02T14:44:34.529278Z"}],"nvd":[{"id":"CVE-2019-3653","description":"Improper access control vulnerability in Configuration tool in McAfee Endpoint Security (ENS) Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool.","status":"published","published":"2019-10-09T16:15:16.14Z","modified":"2026-06-17T02:35:21.22Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:05:31.019577Z"}]}}