PT-2018-17706 · Mcafee · Epolicy Orchestrator

Leonjza · Published 2018-06-15 · Updated 2019-10-09 · CVE-2018-6671

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator (ePO) versions 5.3.0 through 5.3.3 McAfee ePolicy Orchestrator (ePO) versions 5.9.0 through 5.9.1

Description The issue allows remote authenticated users to bypass localhost only access security protection for some features via a specially crafted HTTP request.

Recommendations For versions 5.3.0 through 5.3.3, update to a version outside of this range to resolve the issue. For versions 5.9.0 through 5.9.1, update to a version outside of this range to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2018-6671

Affected Products

Epolicy Orchestrator

References · 6

• 🔥 https://exploit-db.com/exploits/46518 · Exploit
• https://osv.dev/vulnerability/CVE-2018-6671 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6671 · Security Note
• http://securityfocus.com/bid/104485 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10240 · Note
• http://securitytracker.com/id/1041155 · Note