McAfee ePolicy Orchestrator Multiple Vulnerabilities (SB10387)

medium Nessus Plugin ID 166139

Language:

Synopsis

A security management application running on the remote host is affected by multiple vulnerabilities

Description

The instance of McAfee ePolicy Orchestrator installed on the remote host is affected by multiple vulnerabilities, including the following:

- An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API. (CVE-2022-3338)

- A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO. (CVE-2022-3339)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version

Solution

Upgrade to McAfee ePO version 5.10.0 Update 14 or later.

Plugin Details

Severity: Medium

ID: 166139

File Name: mcafee_epo_sb10387.nasl

Version: 1.5

Type: local

Agent: windows

Family: Windows

Published: 10/14/2022

Updated: 11/29/2022

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2022-3339

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:mcafee:epolicy_orchestrator

Required KB Items: SMB/Registry/Enumerated, installed_sw/McAfee ePO

Exploit Ease: No known exploits are available

Patch Publication Date: 10/11/2022

Vulnerability Publication Date: 10/11/2022

Reference Information

CVE: CVE-2022-3338, CVE-2022-3339

IAVA: 2022-A-0420

MCAFEE-SB: SB10387

Detections

Analytics