8

CVE-2023-5444

CSRF in ePO leading to privilege escalation

A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new user with administrator privileges to the ePO server. This impacts the dashboard area of the user interface. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mcafee ≫ Epolicy Orchestrator Version < 5.10.0
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update service_pack_1_update
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update service_pack_1_update_1
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_1
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_10
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_11
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_11_hotfix_1
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_11_hotfix_2
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_12
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_13
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_14
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_15
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_2
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_3
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_4
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_5
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_6
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_7
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_8
Mcafee ≫ Epolicy Orchestrator Version 5.10.0 Update update_9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.267
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8 2.1 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Trellix 8 2.1 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

https://kcm.trellix.com/agent/index?page=content&id=SB10410
Permissions Required