CVE-2014-2205 — XML External Entity (XXE) Injection in Epolicy Orchestrator

CWE-2643 documents3 sources
Severity
6.3MEDIUMNVD
EPSS
0.4%
top 41.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mcafee Epolicy Orchestrator
Timeline
PublishedFeb 26
Latest updateMay 14

Description

The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add dashboards to read arbitrary files by importing a crafted XML file, related to an XML External Entity (XXE) issue.

CVSS vector

AV:N/AC:M/C:C/I:N/A:NExploitability: 6.8 | Impact: 6.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-75mf-4cr8-98gx: The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4↗2022-05-14
▶
CVEList
CVE-2014-2205: The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4↗2014-02-26
▶
CVE-2014-2205 — XML External Entity (XXE) Injection | cvebase