CVE-2023-5444: CSRF in ePO leading to privilege escalation
First published: Fri Nov 17 2023(Updated: )
A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new user with administrator privileges to the ePO server. This impacts the dashboard area of the user interface. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server.
Credit: trellixpsirt@trellix.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| McAfee ePolicy Orchestrator | <5.10.0 | |
| McAfee ePolicy Orchestrator | =5.10.0-service_pack_1_update | |
| McAfee ePolicy Orchestrator | =5.10.0-service_pack_1_update_1 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_1 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_10 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_11 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_11_hotfix_1 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_11_hotfix_2 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_12 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_13 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_14 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_15 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_2 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_3 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_4 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_5 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_6 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_7 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_8 | |
| McAfee ePolicy Orchestrator | =5.10.0-update_9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this CSRF vulnerability?
The vulnerability ID for this CSRF vulnerability is CVE-2023-5444.
What is the severity of CVE-2023-5444?
The severity of CVE-2023-5444 is high (8 out of 10).
Which software version is affected by CVE-2023-5444?
The ePolicy Orchestrator version prior to 5.10.0 CP1 Update 2 is affected by CVE-2023-5444.
How can an attacker exploit this vulnerability?
To exploit this vulnerability, the attacker must perform a Cross Site Request Forgery attack.
Is there a fix available for CVE-2023-5444?
Yes, the fix for CVE-2023-5444 is to update ePolicy Orchestrator to version 5.10.0 CP1 Update 2 or later.
- collector/nvd-api
- agent/weakness
- agent/type
- agent/references
- agent/severity
- agent/title
- agent/author
- agent/tags
- agent/description
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/mcafee
- canonical/mcafee epolicy orchestrator
- version/mcafee epolicy orchestrator/5.10.0-service_pack_1_update
- version/mcafee epolicy orchestrator/5.10.0-service_pack_1_update_1
- version/mcafee epolicy orchestrator/5.10.0-update_1
- version/mcafee epolicy orchestrator/5.10.0-update_10
- version/mcafee epolicy orchestrator/5.10.0-update_11
- version/mcafee epolicy orchestrator/5.10.0-update_11_hotfix_1
- version/mcafee epolicy orchestrator/5.10.0-update_11_hotfix_2
- version/mcafee epolicy orchestrator/5.10.0-update_12
- version/mcafee epolicy orchestrator/5.10.0-update_13
- version/mcafee epolicy orchestrator/5.10.0-update_14
- version/mcafee epolicy orchestrator/5.10.0-update_15
- version/mcafee epolicy orchestrator/5.10.0-update_2
- version/mcafee epolicy orchestrator/5.10.0-update_3
- version/mcafee epolicy orchestrator/5.10.0-update_4
- version/mcafee epolicy orchestrator/5.10.0-update_5
- version/mcafee epolicy orchestrator/5.10.0-update_6
- version/mcafee epolicy orchestrator/5.10.0-update_7
- version/mcafee epolicy orchestrator/5.10.0-update_8
- version/mcafee epolicy orchestrator/5.10.0-update_9