CVE-2013-0140
published 2013-05-01CVE-2013-0140: SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to…
PriorityP351high7.9CVSS 2.0
AVAACMAuNCCICAC
EXPLOIT
EPSS
2.54%
83.0th percentile
SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mcafee | epolicy_orchestrator | <= 4.5.6 | — |
| mcafee | epolicy_orchestrator | <= 4.6.6 | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator | — | — |
| mcafee | epolicy_orchestrator_agent | — | — |
| mcafee | epolicy_orchestrator_agent | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r8g4-4j5g-w475: Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4
ghsa_unreviewed·2022-05-17·CVSS 7.9
CVE-2013-4882 [HIGH] CWE-89 GHSA-r8g4-4j5g-w475: Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4
Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA) 4.5 and 4.6, allow remote authenticated users to execute arbitrary SQL commands via the uid parameter to (1) core/showRegisteredTypeDetails.do and (2) EPOAGENTMETA/DisplayMSAPropsDetail.do, a different vulnerability than CVE-2013-0140.
GHSA
GHSA-qwj4-q777-wg6h: SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4
ghsa_unreviewed·2022-05-05
CVE-2013-0140 [HIGH] CWE-89 GHSA-qwj4-q777-wg6h: SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4
SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.
No detection rules found.
No writeups or analysis indexed.
http://seclists.org/fulldisclosure/2014/Apr/289http://www.kb.cert.org/vuls/id/209131http://www.securityfocus.com/bid/59500http://www.us-cert.gov/ncas/alerts/TA13-193Ahttps://kc.mcafee.com/corporate/index?page=content&id=SB10042http://seclists.org/fulldisclosure/2014/Apr/289http://www.kb.cert.org/vuls/id/209131http://www.securityfocus.com/bid/59500http://www.us-cert.gov/ncas/alerts/TA13-193Ahttps://kc.mcafee.com/corporate/index?page=content&id=SB10042
2013-05-01
Published