CVE-2022-1258CWE-89

SQL injection vulnerability in McAfee Agent's ePO extension

High · published April 14, 2022

CVSS v3.1
8.4
EPSS
1%
Percentile
62.3
In the wild
Unconfirmed
What it is

A blind SQL injection vulnerability in the ePolicy Orchestrator (ePO) extension of MA prior to 5.7.6 can be exploited by an authenticated administrator on ePO to perform arbitrary SQL queries in the back-end database, potentially leading to command execution on the server.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00996 · 62.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2022-04-14T13:50Z
EPSS history
Timeline
  • 14 APR 13:50Z
    SQL injection vulnerability in McAfee Agent's ePO extension
    cvelistv5