CVE-2013-4882: SQL Injection
First published: Sun Jul 21 2013(Updated: )
Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA) 4.5 and 4.6, allow remote authenticated users to execute arbitrary SQL commands via the uid parameter to (1) core/showRegisteredTypeDetails.do and (2) EPOAGENTMETA/DisplayMSAPropsDetail.do, a different vulnerability than CVE-2013-0140.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| McAfee ePolicy Orchestrator | <=4.6.6 | |
| McAfee ePolicy Orchestrator | =4.6.0 | |
| McAfee ePolicy Orchestrator | =4.6.1 | |
| McAfee ePolicy Orchestrator | =4.6.2 | |
| McAfee ePolicy Orchestrator | =4.6.3 | |
| McAfee ePolicy Orchestrator | =4.6.4 | |
| McAfee ePolicy Orchestrator | =4.6.5 | |
| Trellix ePolicy Orchestrator | =4.5 | |
| Trellix ePolicy Orchestrator | =4.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-4882?
CVE-2013-4882 has a CVSS score that indicates a medium severity due to its potential impact from SQL injection vulnerabilities.
How do I fix CVE-2013-4882?
To mitigate CVE-2013-4882, users should upgrade to the latest version of McAfee ePolicy Orchestrator beyond version 4.6.6.
What systems are affected by CVE-2013-4882?
CVE-2013-4882 affects McAfee ePolicy Orchestrator versions 4.6.6 and earlier, as well as the ePolicy Orchestrator extension for McAfee Agent versions 4.5 and 4.6.
Can CVE-2013-4882 be exploited remotely?
Yes, CVE-2013-4882 can be exploited remotely by authenticated users to execute arbitrary SQL commands.
What type of vulnerability is CVE-2013-4882?
CVE-2013-4882 is classified as a SQL injection vulnerability.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/references
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/mcafee
- canonical/mcafee epolicy orchestrator
- version/mcafee epolicy orchestrator/4.6.6
- version/mcafee epolicy orchestrator/4.6.0
- version/mcafee epolicy orchestrator/4.6.1
- version/mcafee epolicy orchestrator/4.6.2
- version/mcafee epolicy orchestrator/4.6.3
- version/mcafee epolicy orchestrator/4.6.4
- version/mcafee epolicy orchestrator/4.6.5
- canonical/trellix epolicy orchestrator
- version/trellix epolicy orchestrator/4.5
- version/trellix epolicy orchestrator/4.6