ePO XML extended entity vulnerability
CVE-2022-0861

3.5LOW

Key Information:

Vendor
Mcafee,llc
Status
Mcafee Epolicy Orchestrator (epo)
Vendor
CVE Published:
23 March 2022

Summary

A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.

Affected Version(s)

McAfee ePolicy Orchestrator (ePO) < 5.10 CU 13

References

https://kc.mcafee.com/corporate/index?page=content&id=SB1...
x_refsource_CONFIRM

CVSS V3.1

Score:
3.5
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.