CVE-2022-0842: falha de média gravidade em McAfee ePolicy Orchestrator (ePO)
ePO blind SQL Injection vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.8%
A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain information from the ePO database. The data obtained is dependent on the privileges the attacker has and to obtain sensitive data the attacker would require administrator privileges.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
Produtos afetados
McAfee,LLC · McAfee ePolicy Orchestrator (ePO)CVEs relacionadas — McAfee ePolicy Orchestrator (ePO)
No mesmo produto, das mais perigosas para as menos.
CVE-2021-23890MEDIUMMcAfee ePO Information Leak vulnerabilityEPSS 0.9%CVE-2022-0858MEDIUMCross-site scripting vulnerability in ePOEPSS 0.8%CVE-2022-0857MEDIUMePO Reflected Cross-site scripting vulnerabilityEPSS 0.7%CVE-2022-0862LOWePO password change vulnerabilityEPSS 0.7%CVE-2021-23888MEDIUMMcAfee ePO unvalidated URL redirect vulnerabilityEPSS 0.6%CVE-2021-31835MEDIUMMcAfee ePO Cross-Site Scripting vulnerabilityEPSS 0.6%