CVE-2018-6671

SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerability

CVSS 4.7 MEDIUMEPSS 4.7%

Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

McAfee · ePolicy Orchestrator (ePO)

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/46518/unverified exploitdbwww.exploit-db.com/exploits/46518unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10240 https://www.exploit-db.com/exploits/46518/http://www.securityfocus.com/bid/104485 http://www.securitytracker.com/id/1041155