CVE-2024-4844: High severity Trellix ePolicy Orchestrator vulnerability
Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was possible through using a hard coded password for the keystore. Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Trellix ePolicy Orchestrator (ePO) on Premiseto a version that resolves this vulnerability.Fixed in 5.10 Service Pack 1 Update 2 - Configuration
Ensure that access to the ePO server (and specifically the orion.keystore file on the ePO host) is restricted so only the system admin can access it; exploitation described requires admin privileges on the ePO server.
Trellix ePolicy Orchestrator (ePO) on Premise keystore access = Require system admin privileges for access to orion.keystore (non-admin users cannot exploit)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4844?
CVE-2024-4844 is considered a high severity vulnerability due to the potential unauthorized access to sensitive encryption keys.
How do I fix CVE-2024-4844?
To fix CVE-2024-4844, upgrade your Trellix ePolicy Orchestrator to version 5.10 Service Pack 1 Update 2 or later.
Who is affected by CVE-2024-4844?
CVE-2024-4844 affects Trellix ePolicy Orchestrator installations prior to version 5.10 Service Pack 1 Update 2.
What are the implications of CVE-2024-4844?
The implications of CVE-2024-4844 include potential unauthorized access to the ePO database encryption key, compromising data security.
Can CVE-2024-4844 be exploited remotely?
CVE-2024-4844 requires an attacker to have admin privileges on the ePO server, limiting the exploitability to existing users with those privileges.