« Volver al listado

CVE-2015-2859

Estado: ModificadaMedia (5.8)—

Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mcafee — Epolicy Orchestrator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-2859",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-06-23T21:59:00.240",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/264092",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/75020",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1032571",
      "source": "cret@cert.org"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=KB84628",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10120",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/264092",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/75020",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1032571",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=KB84628",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10120",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
    },
    {
      "lang": "es",
      "value": "Intel McAfee ePolicy Orchestrator (ePO) 4.x hasta 4.6.9 y 5.x hasta 5.1.2 no valida los nombres de servidores y los nombres de de autoridades certificadoras en los certificados X.509 de servidores SSL, lo que permite a atacantes man-in-the-middle falsificar servidores y obtener información sensible a través de un certificado manipulado."
    }
  ],
  "lastModified": "2026-06-17T00:24:52.830",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "485DB16F-730A-44B2-A255-2583AB27DB9C"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1C721D48-5D9B-4BFF-8A7F-6E88D1F78F34"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B6131764-811B-4302-B160-D6447D20795E"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4773B847-1E1D-4106-88CF-35E38412466E"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADCCFECD-BFB3-415D-B381-D0FC714E8434"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BA5473B-AF93-46A4-A28B-50B9E82BAFCE"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9C4BAB1-E198-477E-9B48-4CC526583A17"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D84606C7-E033-4864-A527-C75F4B7A307E"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F4A1B55-452B-4D1F-908E-795197974F4E"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D5A2CABB-0BCB-4266-BA58-9FC81E89555C"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0080A5E-19E2-4BAA-BA80-1904A774CF8B"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3171A1A7-E1B6-4957-BABE-DC0997ACB27B"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9284BEB-25CF-4888-AFDD-0073080361BE"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30C57CEF-BEAC-4BC8-9CBE-17B797EC52F5"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FBBFF999-B630-4011-97CC-0C85251F7A5B"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.8:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98B45EBD-531A-4052-82E0-BE3F43132337"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.9:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DA7EEDB-DFCE-464D-A4C3-7727BCF57E2D"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BD14FE96-A47F-4C92-90E8-678D93BB4CB3"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "648AAB2A-310B-493E-89DF-E8BCA56FB6FD"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE33AFB8-9962-4D75-B613-D5032A0949A1"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEBA52A8-233F-4015-B44B-1BF7B5593CCE"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0DBB72F-A984-4641-9230-97B815FCD31C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}