Information disclosure in Mcafee Epolicy Orchestrator
CVE-2015-0922
McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
Vulnerability class: Information Disclosure
EPSS: 0.133 (96.0th percentile) — read the EPSS interpretation.
Affected products
- Mcafee Epolicy_orchestrator — versions 5.0.0, 5.0.1, 5.1.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, vdb-entry, x_refsource_BID)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (mailing-list, x_refsource_FULLDISC)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (vdb-entry, x_refsource_SECTRACK)
- cve@mitre.org (x_refsource_MISC)
Frequently asked questions
- What is CVE-2015-0922?
- CVE-2015-0922 is a vulnerability in Mcafee Epolicy Orchestrator, classified under Information Disclosure. Published 2015-01-09.
- Is CVE-2015-0922 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.