CVE-2021-23890

McAfee ePO Information Leak vulnerability

State: Published
Severity: 6.5 Medium
Published: Mar 26, 2021
Updated: Aug 3, 2024
Reserved: Jan 12, 2021

Description

Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages (specifically McAfee Agent) available in ePO repository and install them on their own machines to have it managed and then in turn get policy details from the ePO server. This can only happen when the ePO Agent Handler is installed in a Demilitarized Zone (DMZ) to service machines not connected to the network through a VPN.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N	trellix

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
McAfee ePolicy Orchestrator (ePO)McAfee,LLC	before 5.10 CU 10Affected

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10352

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.