CVE-2022-0842: medium-severity vulnerability in McAfee ePolicy Orchestrator (ePO)
ePO blind SQL Injection vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.4epss 0.8%
A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain information from the ePO database. The data obtained is dependent on the privileges the attacker has and to obtain sensitive data the attacker would require administrator privileges.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
Affected products
McAfee,LLC · McAfee ePolicy Orchestrator (ePO)Related CVEs — McAfee ePolicy Orchestrator (ePO)
In the same product, most dangerous first.
CVE-2021-23890MEDIUMMcAfee ePO Information Leak vulnerabilityEPSS 0.9%CVE-2022-0858MEDIUMCross-site scripting vulnerability in ePOEPSS 0.8%CVE-2022-0857MEDIUMePO Reflected Cross-site scripting vulnerabilityEPSS 0.7%CVE-2022-0862LOWePO password change vulnerabilityEPSS 0.7%CVE-2021-23888MEDIUMMcAfee ePO unvalidated URL redirect vulnerabilityEPSS 0.6%CVE-2021-31835MEDIUMMcAfee ePO Cross-Site Scripting vulnerabilityEPSS 0.6%