CVE-2015-0922: mcafee epolicy_orchestrator
Vulnerability summary
CVE-2015-0922 is a medium (CVSS 5.0) vulnerability in mcafee epolicy_orchestrator. EPSS estimates a 13.35% chance of exploitation in the next 30 days, higher than 96.3% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 09-01-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
13.35%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 13.35% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (securityfocus.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure
auxiliary/gather/mcafee_epo_xxe
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Mcafee1 product
- epolicy_orchestrator≤ 4.6.8 | 5.0.0 | 5.0.1 | 5.1.0 | 5.1.1
1 vendor · 1 product
References
8 links- gist.github.com/brandonprry/692e553975bf29aeaf2cX Refsource MISC