CVE-2022-0859

Published: Mar 23, 2022Modified: Jun 17, 2026

6.7

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.8 / Impact: 5.9

Source: NVD

Description

McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password.

Affected (14)

Products: Mcafee: Epolicy Orchestrator

Mcafee

1 product

Epolicy Orchestrator

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Mcafee Epolicy Orchestrator	Before 5.10.0
Mcafee Epolicy Orchestrator	Version 5.10.0
Mcafee Epolicy Orchestrator	Version 5.10.0 update_10
Mcafee Epolicy Orchestrator	Version 5.10.0 update_11
Mcafee Epolicy Orchestrator	Version 5.10.0 update_12
Mcafee Epolicy Orchestrator	Version 5.10.0 update_1
Mcafee Epolicy Orchestrator	Version 5.10.0 update_2
Mcafee Epolicy Orchestrator	Version 5.10.0 update_3
Mcafee Epolicy Orchestrator	Version 5.10.0 update_4
Mcafee Epolicy Orchestrator	Version 5.10.0 update_5
Mcafee Epolicy Orchestrator	Version 5.10.0 update_6
Mcafee Epolicy Orchestrator	Version 5.10.0 update_7
Mcafee Epolicy Orchestrator	Version 5.10.0 update_8
Mcafee Epolicy Orchestrator	Version 5.10.0 update_9

Related CWEs

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (2)

https://kc.mcafee.com/corporate/index?page=content&id=SB10379

Source: trellixpsirt@trellix.com

Broken Link

https://kc.mcafee.com/corporate/index?page=content&id=SB10379

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.