CVE-2022-0859 MEDIUM

CVE-2022-0859: ePO database restoration vulnerability

Vendor Mcafee,Llc
Product McAfee ePolicy Orchestrator (ePO)
Weakness CWE-522 · Insufficiently protected credentials
Published March 23, 2022
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password.

Key dates

02Disclosure timeline

March 23, 2022 CVE published
August 2, 2024 Record updated