CVE-2022-0859CWE-522

ePO database restoration vulnerability

Medium · published March 23, 2022

CVSS v3.1
6.5
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00210 · 10.6th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2022-03-23T14:20Z
EPSS history
Timeline
  • 23 MAR 14:20Z
    ePO database restoration vulnerability
    cvelistv5