PT-2019-2806 · Mcafee · Mcafee Epolicy Orchestrator

Published 2019-07-02 · Updated 2020-08-24 · CVE-2019-3619

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator versions 5.9.x through 5.10.0 prior to update 4

Description The issue is related to a lack of protection for service data in the Agent Handler component of McAfee ePolicy Orchestrator. This can be exploited by a remote attacker to disclose protected information by reading the traffic between the Agent Handler and the SQL server.

Recommendations For versions 5.9.x through 5.10.0 prior to update 4, update to version 5.10.0 update 4 or later to resolve the issue. As a temporary workaround, consider restricting access to the traffic between the Agent Handler and the SQL server to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-319

CWE-200

Related Identifiers

BDU:2019-02761

CVE-2019-3619

Affected Products

Mcafee Epolicy Orchestrator

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2019-3619 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3619 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02761 · Security Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10286 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10286 · Note
• http://securityfocus.com/bid/109066 · Note
• https://vuldb.com/?id.137241 · Note
• https://t.me/defcon_news/18476 · Telegram Post
• https://exploit.kitploit.com/2019/07/mcafee-epolicy-orchestrator-cve-2019.html · Note