4

CVE-2015-0921

Exploit

EPSS 58.22%
Veröffentlicht 09.01.2015 18:59:10
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle cve@mitre.org
Teams Watchlist Login
Unerledigt Login

XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 11

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mcafee ≫ Epolicy Orchestrator Version <= 4.6.8

Mcafee ≫ Epolicy Orchestrator Version5.0.0

Mcafee ≫ Epolicy Orchestrator Version5.0.1

Mcafee ≫ Epolicy Orchestrator Version5.1.0

Mcafee ≫ Epolicy Orchestrator Version5.1.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	58.22%	0.98

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4	8	2.9	AV:N/AC:L/Au:S/C:P/I:N/A:N

http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html

Third Party Advisory

Exploit

VDB Entry

http://seclists.org/fulldisclosure/2015/Jan/37

Third Party Advisory

Mailing List

http://seclists.org/fulldisclosure/2015/Jan/8

Third Party Advisory

Mailing List

http://secunia.com/advisories/61922

http://www.securitytracker.com/id/1031519

https://exchange.xforce.ibmcloud.com/vulnerabilities/99950

https://gist.github.com/brandonprry/692e553975bf29aeaf2c

https://kc.mcafee.com/corporate/index?page=content&id=SB10095

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2015-0921

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-0921

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-0921

EUVD