2023-04-24 12:24:31 +02:00
{
"id" : "CVE-2022-3338" ,
"sourceIdentifier" : "trellixpsirt@trellix.com" ,
"published" : "2022-10-18T10:15:10.637" ,
2024-12-08 03:06:42 +00:00
"lastModified" : "2024-11-21T07:19:19.557" ,
"vulnStatus" : "Modified" ,
2024-07-14 02:06:08 +00:00
"cveTags" : [ ] ,
2023-04-24 12:24:31 +02:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API."
} ,
{
"lang" : "es" ,
"value" : "Una vulnerabilidad de tipo External XML entity (XXE) en ePO versiones anteriores a la actualizaci\u00f3n 5.10 14, puede conllevar a que un atacante remoto no autenticado desencadene potencialmente un ataque de tipo Server Side Request Forgery. Esto puede ser explotado al imitar la llamada del Manejador de Agentes a ePO y pasando el archivo XML cuidadosamente construido mediante la API"
}
] ,
"metrics" : {
"cvssMetricV31" : [
{
2024-12-08 03:06:42 +00:00
"source" : "trellixpsirt@trellix.com" ,
"type" : "Secondary" ,
2023-04-24 12:24:31 +02:00
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 5.4 ,
"baseSeverity" : "MEDIUM" ,
2023-04-24 12:24:31 +02:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "HIGH" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "NONE"
2023-04-24 12:24:31 +02:00
} ,
"exploitabilityScore" : 2.2 ,
"impactScore" : 2.7
} ,
{
2024-12-08 03:06:42 +00:00
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
2023-04-24 12:24:31 +02:00
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N" ,
2024-12-08 03:06:42 +00:00
"baseScore" : 5.4 ,
"baseSeverity" : "MEDIUM" ,
2023-04-24 12:24:31 +02:00
"attackVector" : "NETWORK" ,
"attackComplexity" : "HIGH" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "NONE" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
2024-12-08 03:06:42 +00:00
"availabilityImpact" : "NONE"
2023-04-24 12:24:31 +02:00
} ,
"exploitabilityScore" : 2.2 ,
"impactScore" : 2.7
}
]
} ,
"weaknesses" : [
{
2024-12-08 03:06:42 +00:00
"source" : "trellixpsirt@trellix.com" ,
"type" : "Secondary" ,
2023-04-24 12:24:31 +02:00
"description" : [
{
"lang" : "en" ,
"value" : "CWE-611"
}
]
} ,
{
2024-12-08 03:06:42 +00:00
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
2023-04-24 12:24:31 +02:00
"description" : [
{
"lang" : "en" ,
"value" : "CWE-611"
}
]
}
] ,
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "5.10.0" ,
"matchCriteriaId" : "A30F7908-5AF6-4761-BC6A-4C18EFAE48E5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*" ,
"matchCriteriaId" : "7B00DDE7-7002-45BE-8EDE-65D964922CB0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*" ,
"matchCriteriaId" : "DB88C165-BB24-49FB-AAF6-087A766D5AD1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:*" ,
"matchCriteriaId" : "C879487A-3378-4C5D-9DA6-308D06B786A0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:*" ,
"matchCriteriaId" : "523E143F-E8B3-4B24-AD64-65BF5A8677A7"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_13:*:*:*:*:*:*" ,
"matchCriteriaId" : "3AF53482-AE68-40F8-8FA6-0A2DAC019A34"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*" ,
"matchCriteriaId" : "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*" ,
"matchCriteriaId" : "7DE847E0-431D-497D-9C57-C4E59749F6A0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*" ,
"matchCriteriaId" : "46385384-5561-40AA-9FDE-A2DE4FDFAD3E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*" ,
"matchCriteriaId" : "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*" ,
"matchCriteriaId" : "9E4E5481-1070-4E1F-8679-1985DE4E785A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*" ,
"matchCriteriaId" : "D9EEA681-67FF-43B3-8610-0FA17FD279E5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*" ,
"matchCriteriaId" : "C33BA8EA-793D-4E79-BE9C-235ACE717216"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*" ,
"matchCriteriaId" : "823DBE80-CB8D-4981-AE7C-28F3FDD40451"
}
]
}
]
}
] ,
"references" : [
{
"url" : "https://kcm.trellix.com/corporate/index?page=content&id=SB10387" ,
"source" : "trellixpsirt@trellix.com" ,
"tags" : [
"Third Party Advisory"
]
2024-12-08 03:06:42 +00:00
} ,
{
"url" : "https://kcm.trellix.com/corporate/index?page=content&id=SB10387" ,
"source" : "af854a3a-2127-422b-91ae-364da2661108" ,
"tags" : [
"Third Party Advisory"
]
2023-04-24 12:24:31 +02:00
}
]
}
