CVE-2015-2859
Status: ModifiedMedium (5.8)—
Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
- Base score: 5.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.02%
- Percentile among all scored CVEs: 62
- Score date: 10/7/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-310
References
- http://www.kb.cert.org/vuls/id/264092
- http://www.securityfocus.com/bid/75020
- http://www.securitytracker.com/id/1032571
- https://kc.mcafee.com/corporate/index?page=content&id=KB84628
- https://kc.mcafee.com/corporate/index?page=content&id=SB10120
- http://www.kb.cert.org/vuls/id/264092
- http://www.securityfocus.com/bid/75020
- http://www.securitytracker.com/id/1032571
- https://kc.mcafee.com/corporate/index?page=content&id=KB84628
- https://kc.mcafee.com/corporate/index?page=content&id=SB10120
Raw JSON (NVD)
Show
{
"id": "CVE-2015-2859",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5.8,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 4.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cret@cert.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2015-06-23T21:59:00.240",
"references": [
{
"url": "http://www.kb.cert.org/vuls/id/264092",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "cret@cert.org"
},
{
"url": "http://www.securityfocus.com/bid/75020",
"source": "cret@cert.org"
},
{
"url": "http://www.securitytracker.com/id/1032571",
"source": "cret@cert.org"
},
{
"url": "https://kc.mcafee.com/corporate/index?page=content&id=KB84628",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cret@cert.org"
},
{
"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10120",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cret@cert.org"
},
{
"url": "http://www.kb.cert.org/vuls/id/264092",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/75020",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1032571",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://kc.mcafee.com/corporate/index?page=content&id=KB84628",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10120",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-310"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
},
{
"lang": "es",
"value": "Intel McAfee ePolicy Orchestrator (ePO) 4.x hasta 4.6.9 y 5.x hasta 5.1.2 no valida los nombres de servidores y los nombres de de autoridades certificadoras en los certificados X.509 de servidores SSL, lo que permite a atacantes man-in-the-middle falsificar servidores y obtener información sensible a través de un certificado manipulado."
}
],
"lastModified": "2026-06-17T00:24:52.830",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "485DB16F-730A-44B2-A255-2583AB27DB9C"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1C721D48-5D9B-4BFF-8A7F-6E88D1F78F34"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B6131764-811B-4302-B160-D6447D20795E"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4773B847-1E1D-4106-88CF-35E38412466E"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ADCCFECD-BFB3-415D-B381-D0FC714E8434"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4BA5473B-AF93-46A4-A28B-50B9E82BAFCE"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9C4BAB1-E198-477E-9B48-4CC526583A17"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D84606C7-E033-4864-A527-C75F4B7A307E"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F4A1B55-452B-4D1F-908E-795197974F4E"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D5A2CABB-0BCB-4266-BA58-9FC81E89555C"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0080A5E-19E2-4BAA-BA80-1904A774CF8B"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3171A1A7-E1B6-4957-BABE-DC0997ACB27B"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F9284BEB-25CF-4888-AFDD-0073080361BE"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "30C57CEF-BEAC-4BC8-9CBE-17B797EC52F5"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FBBFF999-B630-4011-97CC-0C85251F7A5B"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98B45EBD-531A-4052-82E0-BE3F43132337"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8DA7EEDB-DFCE-464D-A4C3-7727BCF57E2D"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BD14FE96-A47F-4C92-90E8-678D93BB4CB3"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "648AAB2A-310B-493E-89DF-E8BCA56FB6FD"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DE33AFB8-9962-4D75-B613-D5032A0949A1"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEBA52A8-233F-4015-B44B-1BF7B5593CCE"
},
{
"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0DBB72F-A984-4641-9230-97B815FCD31C"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cret@cert.org"
}