CVE-2012-4594: Medium severity mcafee epolicy orchestrator vulnerability
Published Aug 22, 2012
·Updated
McAfee ePolicy Orchestrator (ePO) 4.6.1 and earlier allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information from arbitrary reporting panels, via a modified ID value in a console URL.
Affected Software
14 affected components
McAfee ePolicy Orchestrator
McAfee ePolicy Orchestrator<=4.6.1
McAfee ePolicy Orchestrator=2.0
McAfee ePolicy Orchestrator=2.5
McAfee ePolicy Orchestrator=2.5-sp1
McAfee ePolicy Orchestrator=2.5.1
McAfee ePolicy Orchestrator=3.0
McAfee ePolicy Orchestrator=3.0-sp2a
McAfee ePolicy Orchestrator=3.5.0
McAfee ePolicy Orchestrator=3.6.0
McAfee ePolicy Orchestrator=3.6.1
McAfee ePolicy Orchestrator=4.0
McAfee ePolicy Orchestrator=4.5.0
McAfee ePolicy Orchestrator=4.6.0
Event History
Aug 22, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-4594?
CVE-2012-4594 has a medium severity rating as it allows remote authenticated users to bypass access restrictions.
2
How do I fix CVE-2012-4594?
To fix CVE-2012-4594, upgrade to the latest version of McAfee ePolicy Orchestrator that addresses this vulnerability.
3
Who is affected by CVE-2012-4594?
CVE-2012-4594 affects users of McAfee ePolicy Orchestrator versions 4.6.1 and earlier.
4
What kind of information can be accessed through CVE-2012-4594?
CVE-2012-4594 allows unauthorized access to sensitive information from arbitrary reporting panels.
5
Is there a workaround for CVE-2012-4594?
There are no known effective workarounds for CVE-2012-4594; updating the software is recommended.