Trellix Epolicy Orchestrator (Epo) vulnerabilities

2 vulnerabilities

Known vulnerabilities in Trellix Epolicy Orchestrator (Epo), newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

6.1CVE-2022-3339mcafeeepolicy_orchestrator+1
EPSS score
0.78%
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.5.4CVE-2022-3338mcafeeepolicy_orchestrator+1
EPSS score
0.56%
An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API.