Vulnerability · Published Apr 14, 2022 · Assigned by trellix
CVE-2022-1258SQL injection vulnerability in McAfee Agent's ePO extension
High 8.4
In plain English
A high-severity SQL injection in McAfee Agent ePO extension from McAfee,LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)1.0%top 37.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO to perform arbitrary SQL queries in the back-end database, potentially leading to command execution on the server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| McAfee,LLC | McAfee Agent ePO extension | unspecified – before 5.7.6 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
References
- https://kc.mcafee.com/corporate/index?page=content&id=SB10382 x_refsource_CONFIRM