« Volver al listado

CVE-2024-4844

Estado: AplazadaAlta (7.5)—

Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was possible through using a hard coded password for the keystore. Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Trellix — Epolicy OrchestratorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-4844",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-4844",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-16T15:19:41.030734Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "trellixpsirt@trellix.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "trellixpsirt@trellix.com",
      "affectedData": [
        {
          "vendor": "Trellix",
          "product": "ePolicy Orchestrator",
          "versions": [
            {
              "status": "affected",
              "version": "All versions below ePO 5.10 Service Pack 1 Update 2"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:trellix:epolicy_orchestrator:epo_5.10_service_pack_1_update_2:*:*:*:*:*:*:*"
          ],
          "vendor": "trellix",
          "product": "epolicy_orchestrator",
          "versions": [
            {
              "status": "affected",
              "version": "epo_5.10_service_pack_1_update_2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-16T07:15:50.743",
  "references": [
    {
      "url": "https://thrive.trellix.com/s/article/000013505",
      "source": "trellixpsirt@trellix.com"
    },
    {
      "url": "https://thrive.trellix.com/s/article/000013505",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "trellixpsirt@trellix.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key.  This was possible through using a hard coded password for the keystore.  Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de credenciales codificadas de forma rígida en Trellix ePolicy Orchestrator (ePO) on Premise anterior a la versión 5.10 Service Pack 1 Update 2 permite a un atacante con privilegios de administrador en el servidor ePO leer el contenido del archivo orion.keystore, lo que le permite acceder a la clave de cifrado de la base de datos de ePO. Esto era posible mediante el uso de una contraseña codificada de forma rígida para el almacén de claves. Las restricciones de control de acceso en el archivo significan que esto no sería explotable a menos que el usuario sea el administrador del sistema del servidor en el que se ejecuta ePO."
    }
  ],
  "lastModified": "2026-06-17T08:03:01.860",
  "sourceIdentifier": "trellixpsirt@trellix.com"
}