PT-2024-33110 · Trellix · Trellix Epolicy Orchestrator

David Mayer · Published 2024-05-16 · Updated 2024-05-16 · CVE-2024-4844

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trellix ePolicy Orchestrator (ePO) on Premise versions prior to 5.10 Service Pack 1 Update 2

Description A hardcoded credentials issue allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, accessing the ePO database encryption key. This is possible due to a hard-coded password for the keystore. The vulnerability is only exploitable if the user is the system admin for the server that ePO is running on.

Recommendations For versions prior to 5.10 Service Pack 1 Update 2, update to version 5.10 Service Pack 1 Update 2 or later to resolve the issue. As a temporary workaround, consider restricting access to the orion.keystore file to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-4844

Affected Products

Trellix Epolicy Orchestrator

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2024-4844 · Security Note
• https://thrive.trellix.com/s/article/000013505 · Note
• https://t.me/cvenotify/79981 · Telegram Post