Maple Labs

CVE search · CVE-2022-3338

CVE-2022-3338

medium 5.4

An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
trellixpsirt@trellix.com
Weakness
CWE-611

Severity

VersionScoreVectorSource
CVSS 3.1 medium 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N trellixpsirt@trellix.comSecondary
CVSS 3.1 medium 5.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

  • mcafee · epolicy_orchestrator

References