CVE-2021-23890

Description

Information leak vulnerability in the Agent Handler of McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows an unauthenticated user to download McAfee product packages (specifically McAfee Agent) available in ePO repository and install them on their own machines to have it managed and then in turn get policy details from the ePO server. This can only happen when the ePO Agent Handler is installed in a Demilitarized Zone (DMZ) to service machines not connected to the network through a VPN.

Related CPE's

amcafeeepolicy_orchestrator********
vulnerable
amcafeeepolicy_orchestrator5.10.0-******
vulnerable
amcafeeepolicy_orchestrator5.10.0update_1******
vulnerable
amcafeeepolicy_orchestrator5.10.0update_2******
vulnerable
amcafeeepolicy_orchestrator5.10.0update_3******
vulnerable
amcafeeepolicy_orchestrator5.10.0update_4******
vulnerable
amcafeeepolicy_orchestrator5.10.0update_5******
vulnerable
amcafeeepolicy_orchestrator5.10.0update_6******
vulnerable
amcafeeepolicy_orchestrator5.10.0update_7******
vulnerable
amcafeeepolicy_orchestrator5.10.0update_8******
vulnerable

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10352

Vendor Advisory

CvssV3 impact

BaseSeverity

MEDIUM

ConfidentialityImpact

LOW

AttackComplexity

LOW

Scope

UNCHANGED

AttackVector

NETWORK

AvailabilityImpact

NONE

IntegrityImpact

LOW

PrivilegesRequired

NONE

BaseScore

6.5

VectorString

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Version

3.1

UserInteraction

NONE

CvssV2 impact

AccessComplexity

MEDIUM

ConfidentialityImpact

PARTIAL

AvailabilityImpact

NONE

IntegrityImpact

PARTIAL

BaseScore

5.8

VectorString

AV:N/AC:M/Au:N/C:P/I:P/A:N

Version

2.0

AccessVector

NETWORK

Authentication

NONE