Vulnerability · Published Mar 23, 2022 · Assigned by trellix
CVE-2022-0861ePO XML extended entity vulnerability
Low 3.5
In plain English
A low-severity XML external entity in McAfee ePolicy Orchestrator (ePO) from McAfee,LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.5%top 59.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| McAfee,LLC | McAfee ePolicy Orchestrator (ePO) | unspecified – before 5.10 CU 13 |
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
References
- https://kc.mcafee.com/corporate/index?page=content&id=SB10379 x_refsource_CONFIRM