CVE-2022-3338

published 2022-10-18

CVE-2022-3338: An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side…

Priority P4 32 medium 5.4 CVSS 3.1

AV N AC H PR N UI N S C C L I L A N

An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
mcafee	epolicy_orchestrator	< 5.10.0	5.10.0
mcafee	epolicy_orchestrator	—	—
trellix	trellix_epolicy_orchestrator	>= unspecified < 5.10 Update 14	5.10 Update 14

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-611