CVE-2015-0921

XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.

Score

CVSS 2.0 4.0 Medium

Status

Modified - cve@mitre.org

Published

2015-01-09

Last modified

2024-08-06

Affected products

• Epolicy Orchestrator (Mcafee)

References

• http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html
• http://seclists.org/fulldisclosure/2015/Jan/37
• http://seclists.org/fulldisclosure/2015/Jan/8
• http://secunia.com/advisories/61922
• http://www.securitytracker.com/id/1031519
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99950
• https://gist.github.com/brandonprry/692e553975bf29aeaf2c
• https://kc.mcafee.com/corporate/index?page=content&id=SB10095