CVE-2015-0921

XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2015/Jan/37	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2015/Jan/8	Mailing List Third Party Advisory
http://secunia.com/advisories/61922
http://www.securitytracker.com/id/1031519
https://exchange.xforce.ibmcloud.com/vulnerabilities/99950
https://gist.github.com/brandonprry/692e553975bf29aeaf2c
https://kc.mcafee.com/corporate/index?page=content&id=SB10095	Patch Vendor Advisory
http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html	Exploit Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2015/Jan/37	Mailing List Third Party Advisory
http://seclists.org/fulldisclosure/2015/Jan/8	Mailing List Third Party Advisory
http://secunia.com/advisories/61922
http://www.securitytracker.com/id/1031519
https://exchange.xforce.ibmcloud.com/vulnerabilities/99950
https://gist.github.com/brandonprry/692e553975bf29aeaf2c
https://kc.mcafee.com/corporate/index?page=content&id=SB10095	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mcafee:epolicy_orchestrator::::::::
	cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.0:::::::*
	cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.1:::::::*
	cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.0:::::::*
	cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.1:::::::*

History

No history.

Information

Published : 2015-01-09 18:59

Updated : 2025-04-12 10:46

NVD link : CVE-2015-0921

Mitre link : CVE-2015-0921

CVE.ORG link : CVE-2015-0921

JSON object : View

Products Affected

mcafee

epolicy_orchestrator

CWE

NVD-CWE-Other

{"id": "CVE-2015-0921", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-01-09T18:59:10.600", "references": [{"url": "http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2015/Jan/37", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2015/Jan/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/61922", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id/1031519", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99950", "source": "cve@mitre.org"}, {"url": "https://gist.github.com/brandonprry/692e553975bf29aeaf2c", "source": "cve@mitre.org"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10095", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2015/Jan/37", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://seclists.org/fulldisclosure/2015/Jan/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/61922", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1031519", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99950", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://gist.github.com/brandonprry/692e553975bf29aeaf2c", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10095", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do."}, {"lang": "es", "value": "Vulnerabilidad de entidad externa XML (XXE) en el registro Server Task en McAfee ePolicy Orchestrator (ePO) anterior a 4.6.9 y 5.x anterior a 5.1.2 permite a usuarios remotos autenticados leer ficheros arbitrarios a trav\u00e9s del par\u00e1metro conditionXML en taskLogTable en orionUpdateTableFilter.do."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "013D7347-100A-454B-997B-E74E65B1C8D7", "versionEndIncluding": "4.6.8"}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD14FE96-A47F-4C92-90E8-678D93BB4CB3"}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "648AAB2A-310B-493E-89DF-E8BCA56FB6FD"}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE33AFB8-9962-4D75-B613-D5032A0949A1"}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEBA52A8-233F-4015-B44B-1BF7B5593CCE"}], "operator": "OR"}]}], "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/611.html\">CWE-611: Improper Restriction of XML External Entity Reference ('XXE')</a>", "sourceIdentifier": "cve@mitre.org"}