CVE-2015-0922: Infoleak
First published: Fri Jan 09 2015(Updated: )
McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trellix ePolicy Orchestrator | <=4.6.8 | |
| Trellix ePolicy Orchestrator | =5.0.0 | |
| Trellix ePolicy Orchestrator | =5.0.1 | |
| Trellix ePolicy Orchestrator | =5.1.0 | |
| Trellix ePolicy Orchestrator | =5.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html
- http://seclists.org/fulldisclosure/2015/Jan/37
- http://seclists.org/fulldisclosure/2015/Jan/8
- http://www.securityfocus.com/bid/72298
- http://www.securitytracker.com/id/1031519
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99949
- https://gist.github.com/brandonprry/692e553975bf29aeaf2c
- https://kc.mcafee.com/corporate/index?page=content&id=SB10095
Frequently Asked Questions
What is the severity of CVE-2015-0922?
CVE-2015-0922 has a medium severity rating, indicating a potential risk to affected systems.
How do I fix CVE-2015-0922?
To fix CVE-2015-0922, update McAfee ePolicy Orchestrator to version 4.6.9 or 5.1.2 or higher.
What versions of ePolicy Orchestrator are affected by CVE-2015-0922?
CVE-2015-0922 affects ePolicy Orchestrator versions prior to 4.6.9 and 5.x versions prior to 5.1.2.
What kind of attack can exploit CVE-2015-0922?
CVE-2015-0922 can be exploited by attackers to obtain the administrator password through knowledge of the encrypted password.
Is there a workaround for CVE-2015-0922?
There are no documented workarounds for CVE-2015-0922; updating to a secure version is necessary.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/mcafee
- canonical/mcafee epolicy orchestrator
- version/mcafee epolicy orchestrator/4.6.8
- version/mcafee epolicy orchestrator/5.0.0
- version/mcafee epolicy orchestrator/5.0.1
- version/mcafee epolicy orchestrator/5.1.0
- version/mcafee epolicy orchestrator/5.1.1