CVE-2004-0038 — Epolicy Orchestrator vulnerability

3 documents3 sources
Severity
7.5HIGHNVD
EPSS
1.8%
top 17.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mcafee Epolicy Orchestrator
Timeline
PublishedJun 14
Latest updateApr 29

Description

McAfee ePolicy Orchestrator (ePO) 2.5.1 Patch 13 and 3.0 SP2a Patch 3 allows remote attackers to execute arbitrary commands via certain HTTP POST requests to the spipe/file handler on ePO TCP port 81.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages1 packages

▶NVDmcafee/epolicy_orchestrator2.5, 2.5.1, 3.0+2

Patches

Patch: www.osvdb.org ↗Patch: www.securityfocus.com ↗Patch: xforce.iss.net ↗

🔴Vulnerability Details

2
GHSA
GHSA-r27g-fqf5-pq2m: McAfee ePolicy Orchestrator (ePO) 2↗2022-04-29
▶
CVEList
CVE-2004-0038: McAfee ePolicy Orchestrator (ePO) 2↗2004-04-30
▶
CVE-2004-0038 — Mcafee vulnerability | cvebase