Maple Labs

CVE search · CVE-2022-0862

CVE-2022-0862

medium 5.3

A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session without knowing the existing user's password. This functionality was removed from the User Interface in ePO 10 and the API has now been disabled. Other protection is in place to reduce the likelihood of this being successful through sending a link to a logged in user.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
trellixpsirt@trellix.com
Weakness
CWE-522, CWE-287

Severity

VersionScoreVectorSource
CVSS 3.1 low 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N trellixpsirt@trellix.comSecondary
CVSS 3.1 medium 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N nvd@nist.govPrimary
CVSS 2.0 medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

  • mcafee · epolicy_orchestrator

References