CVE-2022-0861

A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.

Score

CVSS 3.1 3.8 Low

Status

Modified - trellixpsirt@trellix.com

Published

2022-03-23

Last modified

2024-08-02

Weaknesses

CWE-611

Affected products

• Epolicy Orchestrator (Mcafee)
• Mcafee Epolicy Orchestrator Epo (Mcafeellc)

References

• https://kc.mcafee.com/corporate/index?page=content&id=SB10379