Vulnerability · Published Mar 23, 2022 · Assigned by trellix

CVE-2022-0862ePO password change vulnerability

Low 3.1

In plain English

A low-severity security flaw in McAfee ePolicy Orchestrator (ePO) from McAfee,LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.7%top 47.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session without knowing the existing user's password. This functionality was removed from the User Interface in ePO 10 and the API has now been disabled. Other protection is in place to reduce the likelihood of this being successful through sending a link to a logged in user.

Affected products (as reported)

Vendor	Product	Versions
McAfee,LLC	McAfee ePolicy Orchestrator (ePO)	unspecified – before 5.10 CU 13

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10379 x_refsource_CONFIRM