CVEvulnerability

CVE-2015-0921

4.0 MEDIUM Published 2015-01-09 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2015-01-09
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 2.0 ([email protected]): 4.0 MEDIUM — AV:N/AC:L/Au:S/C:P/I:N/A:N

Description

XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.

Affected configurations

• mcafee epolicy orchestrator (<= 4.6.8) • mcafee epolicy orchestrator 5.0.0 • mcafee epolicy orchestrator 5.0.1 • mcafee epolicy orchestrator 5.1.0 • mcafee epolicy orchestrator 5.1.1

References

http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html Exploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jan/37 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2015/Jan/8 Mailing List, Third Party Advisory
http://secunia.com/advisories/61922 secunia.com
http://www.securitytracker.com/id/1031519 www.securitytracker.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/99950 exchange.xforce.ibmcloud.com
https://gist.github.com/brandonprry/692e553975bf29aeaf2c gist.github.com
https://kc.mcafee.com/corporate/index?page=content&id=SB10095 Patch, Vendor Advisory
http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html Exploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jan/37 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2015/Jan/8 Mailing List, Third Party Advisory
http://secunia.com/advisories/61922 secunia.com
http://www.securitytracker.com/id/1031519 www.securitytracker.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/99950 exchange.xforce.ibmcloud.com
https://gist.github.com/brandonprry/692e553975bf29aeaf2c gist.github.com
https://kc.mcafee.com/corporate/index?page=content&id=SB10095 Patch, Vendor Advisory