SSL: McAfee ePolicy CVE-2015-0921 XML Entity Injection
This signature detects an attempt to exploit a known vulnerability against McAfee ePolicy Orchestrator application. Successful exploitation could allow an attacker execute arbitrary codes into the context of the running application which could lead to further attacks.
Extended Description
XML external entity (XXE) vulnerability in the Server Task Log in McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 allows remote authenticated users to read arbitrary files via the conditionXML parameter to the taskLogTable to orionUpdateTableFilter.do.
Affected Products
Mcafee epolicy_orchestrator
Short Name
SSL:EPO-XMLNTITY-INJ
Severity
Major
Recommended
False
Recommended Action
Drop
Category
SSL
Keywords
CVE-2015-0921 CVE-2015-0922 Entity Injection McAfee XML bid:71881 ePolicy
Release Date
02/05/2015
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3761
False Positive
Unknown
Vendors
Mcafee
CVSS Score
4.0
5.0