CVE-2022-0861

Published: Mar 23, 2022Modified: Jun 17, 2026

3.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Exploitability: 1.2 / Impact: 2.5

Source: NVD

Description

A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.

Affected (14)

Products: Mcafee: Epolicy Orchestrator

Mcafee

1 product

Epolicy Orchestrator

Configuration A

14 vulnerable

Vulnerable Software	Affected Versions
Mcafee Epolicy Orchestrator	Before 5.10.0
Mcafee Epolicy Orchestrator	Version 5.10.0
Mcafee Epolicy Orchestrator	Version 5.10.0 update_10
Mcafee Epolicy Orchestrator	Version 5.10.0 update_11
Mcafee Epolicy Orchestrator	Version 5.10.0 update_12
Mcafee Epolicy Orchestrator	Version 5.10.0 update_1
Mcafee Epolicy Orchestrator	Version 5.10.0 update_2
Mcafee Epolicy Orchestrator	Version 5.10.0 update_3
Mcafee Epolicy Orchestrator	Version 5.10.0 update_4
Mcafee Epolicy Orchestrator	Version 5.10.0 update_5
Mcafee Epolicy Orchestrator	Version 5.10.0 update_6
Mcafee Epolicy Orchestrator	Version 5.10.0 update_7
Mcafee Epolicy Orchestrator	Version 5.10.0 update_8
Mcafee Epolicy Orchestrator	Version 5.10.0 update_9

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://kc.mcafee.com/corporate/index?page=content&id=SB10379

Source: trellixpsirt@trellix.com

Broken Link

https://kc.mcafee.com/corporate/index?page=content&id=SB10379

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.