PT-2022-3654 · Mcafee · Epolicy Orchestrator (Epo) Extension Of Ma

Published 2022-04-12 · Updated 2023-11-15 · CVE-2022-1258

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ePolicy Orchestrator (ePO) extension of MA versions prior to 5.7.6

Description A blind SQL injection issue exists in the ePolicy Orchestrator (ePO) extension of MA, related to the failure to neutralize special elements used in SQL queries. This can be exploited by an authenticated administrator on ePO to perform arbitrary SQL queries in the back-end database, potentially leading to command execution on the server. An attacker can exploit this issue by sending specially crafted SQL queries.

Recommendations For versions prior to 5.7.6, update to version 5.7.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the ePO extension to minimize the risk of exploitation. Additionally, restrict the ability to send specially crafted SQL queries to the back-end database until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2022-04439

CVE-2022-1258

Affected Products

Epolicy Orchestrator (Epo) Extension Of Ma

References · 8

• https://bdu.fstec.ru/vul/2022-04439 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1258 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1258 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10382 · Note
• https://habr.com/ru/company/tomhunter/blog/664210 · Note
• https://t.me/cibsecurity/40780 · Telegram Post
• https://kc.mcafee.com/corporate/index?page=content&id=SB10382 · Note