SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerability
CVE-2018-6671

4.7MEDIUM

Key Information:

Vendor

Mcafee
Status
Epolicy Orchestrator (epo)
Vendor
CVE Published:
15 June 2018

What is CVE-2018-6671?

Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.

Affected Version(s)

ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 < 5.3.3 with hotfix EPO5xHF1229850

ePolicy Orchestrator (ePO) 5.9.0 through 5.9.1 < 5.9.1 with hotfix EPO5xHF1229850

References

http://www.securityfocus.com/bid/104485
vdb-entryx_refsource_BID
https://kc.mcafee.com/corporate/index?page=content&id=SB1...
x_refsource_CONFIRM
https://www.exploit-db.com/exploits/46518/
exploitx_refsource_EXPLOIT-DB

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.