CVEvulnerability
CVE-2014-2205
6.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-02-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.3 MEDIUM — AV:N/AC:M/Au:S/C:C/I:N/A:N
- Weaknesses
- CWE-264
Description
The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add dashboards to read arbitrary files by importing a crafted XML file, related to an XML External Entity (XXE) issue.
Affected configurations
• mcafee epolicy orchestrator (<= 4.6.7)
• mcafee epolicy orchestrator 4.6.0
• mcafee epolicy orchestrator 4.6.1
• mcafee epolicy orchestrator 4.6.2
• mcafee epolicy orchestrator 4.6.3
• mcafee epolicy orchestrator 4.6.4
• mcafee epolicy orchestrator 4.6.5
• mcafee epolicy orchestrator 4.6.6
Related
Weakness · not in database (1)
References
- http://secunia.com/advisories/57114 Vendor Advisory
- http://www.securityfocus.com/archive/1/531255/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/65771 www.securityfocus.com
- https://kc.mcafee.com/corporate/index?page=content&id=SB10065 Vendor Advisory
- https://www.redteam-pentesting.de/advisories/rt-sa-2014-001.txt Exploit
- http://secunia.com/advisories/57114 Vendor Advisory
- http://www.securityfocus.com/archive/1/531255/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/65771 www.securityfocus.com
- https://kc.mcafee.com/corporate/index?page=content&id=SB10065 Vendor Advisory
- https://www.redteam-pentesting.de/advisories/rt-sa-2014-001.txt Exploit