CVE-2015-0922

Description

McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10095

https://gist.github.com/brandonprry/692e553975bf29aeaf2c

https://exchange.xforce.ibmcloud.com/vulnerabilities/99949

https://euvd.enisa.europa.eu/vulnerability/EUVD-2015-0930

http://www.securitytracker.com/id/1031519

http://www.securityfocus.com/bid/72298

http://seclists.org/fulldisclosure/2015/Jan/8

http://seclists.org/fulldisclosure/2015/Jan/37

http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS