Vulnerability Details CVE-2015-0922
McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.133
EPSS Ranking 95.9%
CVSS Severity
CVSS v2 Score 5.0
References
- http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html
- http://seclists.org/fulldisclosure/2015/Jan/37
- http://seclists.org/fulldisclosure/2015/Jan/8
- http://www.securityfocus.com/bid/72298
- http://www.securitytracker.com/id/1031519
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99949
- https://gist.github.com/brandonprry/692e553975bf29aeaf2c
- https://kc.mcafee.com/corporate/index?page=content&id=SB10095
- http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html
- http://seclists.org/fulldisclosure/2015/Jan/37
- http://seclists.org/fulldisclosure/2015/Jan/8
- http://www.securityfocus.com/bid/72298
- http://www.securitytracker.com/id/1031519
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99949
- https://gist.github.com/brandonprry/692e553975bf29aeaf2c
- https://kc.mcafee.com/corporate/index?page=content&id=SB10095
Products affected by CVE-2015-0922
-
cpe:2.3:a:mcafee:epolicy_orchestrator:-
-
cpe:2.3:a:mcafee:epolicy_orchestrator:2.0
-
cpe:2.3:a:mcafee:epolicy_orchestrator:2.5
-
cpe:2.3:a:mcafee:epolicy_orchestrator:2.5.1
-
cpe:2.3:a:mcafee:epolicy_orchestrator:3.0
-
cpe:2.3:a:mcafee:epolicy_orchestrator:3.5.0
-
cpe:2.3:a:mcafee:epolicy_orchestrator:3.6.0
-
cpe:2.3:a:mcafee:epolicy_orchestrator:3.6.1
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.0
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.0
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.3
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.4
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.5
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.6
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.5.7
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.0
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.1
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.2
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.3
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.4
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.5
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.6
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.7
-
cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.8
-
cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.0
-
cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.1
-
cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.0
-
cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.1