CVE-2015-0921
First published: Fri Jan 09 2015(Updated: )
XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trellix ePolicy Orchestrator | <=4.6.8 | |
| Trellix ePolicy Orchestrator | =5.0.0 | |
| Trellix ePolicy Orchestrator | =5.0.1 | |
| Trellix ePolicy Orchestrator | =5.1.0 | |
| Trellix ePolicy Orchestrator | =5.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html
- http://seclists.org/fulldisclosure/2015/Jan/37
- http://seclists.org/fulldisclosure/2015/Jan/8
- http://secunia.com/advisories/61922
- http://www.securitytracker.com/id/1031519
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99950
- https://gist.github.com/brandonprry/692e553975bf29aeaf2c
- https://kc.mcafee.com/corporate/index?page=content&id=SB10095
Frequently Asked Questions
What is the severity of CVE-2015-0921?
CVE-2015-0921 has a medium severity rating due to its potential for information disclosure.
How do I fix CVE-2015-0921?
To fix CVE-2015-0921, upgrade to McAfee ePolicy Orchestrator version 4.6.9 or 5.1.2 or later.
Who is affected by CVE-2015-0921?
CVE-2015-0921 affects all versions of McAfee ePolicy Orchestrator prior to 4.6.9 and 5.x before 5.1.2.
What type of vulnerability is CVE-2015-0921?
CVE-2015-0921 is an XML External Entity (XXE) vulnerability that allows remote file access.
Can authenticated users exploit CVE-2015-0921?
Yes, remote authenticated users can exploit CVE-2015-0921 to read arbitrary files.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/remedy
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/mcafee
- canonical/mcafee epolicy orchestrator
- version/mcafee epolicy orchestrator/4.6.8
- version/mcafee epolicy orchestrator/5.0.0
- version/mcafee epolicy orchestrator/5.0.1
- version/mcafee epolicy orchestrator/5.1.0
- version/mcafee epolicy orchestrator/5.1.1