Vulnerability in Mcafee Epolicy Orchestrator
CVE-2015-2859
Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.010 (59.9th percentile) — read the EPSS interpretation.
Affected products
- Mcafee Epolicy_orchestrator — versions 4.0, 4.5.0, 4.5.3
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
- cret@cert.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
- cret@cert.org (vdb-entry, x_refsource_BID)
- cret@cert.org (vdb-entry, x_refsource_SECTRACK)
- cret@cert.org (x_refsource_CONFIRM, Patch, Vendor Advisory)