CVE-2022-0842
ePO blind SQL Injection vulnerability
- State
- Published
- Severity
- 5.4 Medium
- Published
- Mar 23, 2022
- Updated
- Aug 2, 2024
- Reserved
- Mar 3, 2022
Description
A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain information from the ePO database. The data obtained is dependent on the privileges the attacker has and to obtain sensitive data the attacker would require administrator privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N | trellix |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
McAfee ePolicy Orchestrator (ePO)McAfee,LLC |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.