What is CVE-2003-0148?

CVE-2003-0148 is a vulnerability in Mcafee Epolicy Orchestrator. Published 2003-08-27.

Is CVE-2003-0148 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Mcafee Epolicy Orchestrator

CVE-2003-0148

The default installation of MSDE via McAfee ePolicy Orchestrator 2.0 through 3.0 allows attackers to execute arbitrary code via a series of steps that (1) obtain the database administrator username and encrypted password in a configuration file from the ePO server using a certain request, (2) crack the password due to weak cryptography, and (3) use the password to pass commands through xp_cmdshell.

EPSS: 0.006 (43.2th percentile) — read the EPSS interpretation.

Affected products

Mcafee Epolicy_orchestrator — versions 2.0, 2.5, 2.5.1
N/a — versions n/a

Public proof-of-concept exploits

Alman368/MNDefender

References

cve@mitre.org (x_refsource_ATSTAKE, vendor-advisory, Patch, Vendor Advisory)
cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2003-0148?: CVE-2003-0148 is a vulnerability in Mcafee Epolicy Orchestrator. Published 2003-08-27.
Is CVE-2003-0148 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.