XML External Entity Vulnerability in McAfee ePolicy Orchestrator
CVE-2015-0921

Currently unrated

Key Information:

Vendor: Mcafee
Status: Epolicy Orchestrator
Vendor: CVE Published:; 9 January 2015

What is CVE-2015-0921?

An XML external entity (XXE) vulnerability exists in the Server Task Log of McAfee ePolicy Orchestrator prior to version 4.6.9 and versions 5.x before 5.1.2. This flaw allows remote authenticated users to read arbitrary files by exploiting the conditionXML parameter when interacting with the taskLogTable and orionUpdateTableFilter.do. This can lead to unintended information disclosure, thereby compromising the integrity of sensitive data.