« Volver al listado

CVE-2022-0859

Estado: ModificadaMedia (6.7)—

McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mcafee — Epolicy Orchestrator

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-0859",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.4,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "trellixpsirt@trellix.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "trellixpsirt@trellix.com",
      "affectedData": [
        {
          "vendor": "McAfee,LLC",
          "product": "McAfee ePolicy Orchestrator (ePO)",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "5.10 CU 13",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-23T15:15:08.500",
  "references": [
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
      "tags": [
        "Broken Link"
      ],
      "source": "trellixpsirt@trellix.com"
    },
    {
      "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10379",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "trellixpsirt@trellix.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password."
    },
    {
      "lang": "es",
      "value": "McAfee Enterprise ePolicy Orchestrator (ePO) versiones anteriores a la Actualización 5.10 13, permite a un atacante local apuntar un servidor ePO a un servidor SQL arbitrario durante la restauración del servidor ePO. Para conseguirlo, el atacante tendría que haber iniciado sesión en el servidor que aloja el servidor de ePO (restringido a administradores) y conocer la contraseña del servidor SQL"
    }
  ],
  "lastModified": "2026-06-17T04:21:23.090",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A30F7908-5AF6-4761-BC6A-4C18EFAE48E5",
              "versionEndExcluding": "5.10.0"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B00DDE7-7002-45BE-8EDE-65D964922CB0"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB88C165-BB24-49FB-AAF6-087A766D5AD1"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C879487A-3378-4C5D-9DA6-308D06B786A0"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "523E143F-E8B3-4B24-AD64-65BF5A8677A7"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7DE847E0-431D-497D-9C57-C4E59749F6A0"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "46385384-5561-40AA-9FDE-A2DE4FDFAD3E"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E4E5481-1070-4E1F-8679-1985DE4E785A"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9EEA681-67FF-43B3-8610-0FA17FD279E5"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C33BA8EA-793D-4E79-BE9C-235ACE717216"
            },
            {
              "criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "823DBE80-CB8D-4981-AE7C-28F3FDD40451"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "trellixpsirt@trellix.com"
}