CVE-2018-6671 SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerability
MediumCVSS 6.5
EPSS 2.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mcafee epolicy orchestrator | >= 5.3.0, <= 5.3.3 | No fix listed |
| mcafee epolicy orchestrator | >= 5.9.0, <= 5.9.1 | No fix listed |
| mcafee ePolicy Orchestrator (ePO) | >= 5.3.0 through 5.3.3, < 5.3.3 with hotfix EPO5xHF1229850 | 5.3.3 with hotfix EPO5xHF1229850 |
| mcafee ePolicy Orchestrator (ePO) | >= 5.9.0 through 5.9.1, < 5.9.1 with hotfix EPO5xHF1229850 | 5.9.1 with hotfix EPO5xHF1229850 |
References
- 104485 vdb-entry
- 1041155 vdb-entry
- kc.mcafee.com
- 46518 exploit