CVE-2015-2859 — Epolicy Orchestrator vulnerability

CWE-3103 documents3 sources
Severity
5.8MEDIUMNVD
EPSS
0.3%
top 50.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mcafee Epolicy Orchestrator
Timeline
PublishedJun 23
Latest updateMay 17

Description

Intel McAfee ePolicy Orchestrator (ePO) 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVSS vector

AV:N/AC:M/C:P/I:P/A:NExploitability: 8.6 | Impact: 4.9

Affected Packages1 packages

▶NVDmcafee/epolicy_orchestrator22 versions+21

Patches

Patch: kc.mcafee.com ↗Patch: kc.mcafee.com ↗Patch: kc.mcafee.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-rgx9-gm9c-p46j: Intel McAfee ePolicy Orchestrator (ePO) 4↗2022-05-17
▶
CVEList
CVE-2015-2859: Intel McAfee ePolicy Orchestrator (ePO) 4↗2015-06-23
▶
CVE-2015-2859 — Mcafee vulnerability | cvebase