CVE-2022-0861
LOWMcAfee ePolicy Orchestrator < 5.10.0 - Authenticated XML External Entity Injection via Extension Import
Title source: llmDescription
A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.
References (1)
Core 1
Core References
Broken Link x_refsource_confirm
https://kc.mcafee.com/corporate/index?page=content&id=SB10379
Scores
CVSS v3
3.5
EPSS
0.0015
EPSS Percentile
35.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Details
CWE
CWE-611
Status
published
Products (2)
mcafee/epolicy_orchestrator
5.10.0 (13 CPE variants)
mcafee/epolicy_orchestrator
< 5.10.0
Published
Mar 23, 2022
Tracked Since
Feb 18, 2026