PT-2022-13480 · Mcafee · Mcafee Enterprise Epolicy Orchestrator

Published 2022-03-23 · Updated 2023-11-15 · CVE-2022-0861

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions McAfee Enterprise ePolicy Orchestrator versions prior to 5.10 Update 13

Description A XML Extended entity issue allows a remote administrator attacker to upload a malicious XML file through the extension import functionality, resulting in limited access to confidential information and some ability to alter data.

Recommendations For versions prior to 5.10 Update 13, update to version 5.10 Update 13 or later to resolve the issue. As a temporary workaround, consider restricting access to the extension import functionality to minimize the risk of exploitation.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-0861

Affected Products

Mcafee Enterprise Epolicy Orchestrator

References · 4

• https://osv.dev/vulnerability/CVE-2022-0861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0861 · Security Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10379 · Note
• https://t.me/cibsecurity/39411 · Telegram Post