CVE-2015-0922
N/A
N/A
Summary
McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| n/a | n/a | n/a | affected |
Weaknesses
- n/a
ADP Enrichment
CVE Program Container
Additional References
- http://www.securityfocus.com/bid/72298
- http://seclists.org/fulldisclosure/2015/Jan/37
- https://kc.mcafee.com/corporate/index?page=content&id=SB10095
- http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html
- http://seclists.org/fulldisclosure/2015/Jan/8
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99949
- http://www.securitytracker.com/id/1031519
- https://gist.github.com/brandonprry/692e553975bf29aeaf2c
References
- http://www.securityfocus.com/bid/72298
- http://seclists.org/fulldisclosure/2015/Jan/37
- https://kc.mcafee.com/corporate/index?page=content&id=SB10095
- http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html
- http://seclists.org/fulldisclosure/2015/Jan/8
- https://exchange.xforce.ibmcloud.com/vulnerabilities/99949
- http://www.securitytracker.com/id/1031519
- https://gist.github.com/brandonprry/692e553975bf29aeaf2c
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.