SQL Injection in Mcafee Epolicy Orchestrator
CVE-2022-0842
A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain information from the ePO database. The data obtained is dependent on the privileges the attacker has and to obtain sensitive data the attacker would require administrator privileges.
Vulnerability class: SQL Injection
EPSS: 0.008 (51.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N.
Affected products
- Mcafee Epolicy_orchestrator — versions 5.10.0
- Mcafee,llc Mcafee Epolicy Orchestrator (Epo) — versions unspecified
Weakness classification (CWE)
References
- trellixpsirt@trellix.com (x_refsource_CONFIRM, Broken Link)
Frequently asked questions
- What is CVE-2022-0842?
- CVE-2022-0842 is a medium-severity vulnerability in Mcafee Epolicy Orchestrator, classified under SQL Injection. CVSS score: 5.4/10. Published 2022-03-23.
- How severe is CVE-2022-0842?
- Medium severity. CVSS v3 base score is 5.4 out of 10.