CVE-2018-6671

SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerability

Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.

Affected

McAfee · ePolicy Orchestrator (ePO)

CVSS v3.0 NVD

6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v3.0 TRELLIX

4.7 MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

2.58% chance of exploitation in the next 30 days, 85th percentile

Published

2018-06-15

Updated

2024-08-05

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/46518

Security advisories

• http://www.securityfocus.com/bid/104485
• https://kc.mcafee.com/corporate/index?page=content&id=SB10240

References

• CVE Record
• NVD entry