Vulnerability in Mcafee Epolicy Orchestrator
CVE-2015-0921
XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.
EPSS: 0.174 (96.8th percentile) — read the EPSS interpretation.
Affected products
- Mcafee Epolicy_orchestrator — versions 5.0.0, 5.0.1, 5.1.0
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC, Mailing List, Third Party Advisory)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_MISC)
Frequently asked questions
- What is CVE-2015-0921?
- CVE-2015-0921 is a vulnerability in Mcafee Epolicy Orchestrator. Published 2015-01-09.
- Is CVE-2015-0921 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.