{"api_version":"1","generated_at":"2026-07-23T09:18:59+00:00","cve":"CVE-2015-0922","urls":{"html":"https://cve.report/CVE-2015-0922","api":"https://cve.report/api/cve/CVE-2015-0922.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-0922","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-0922"},"summary":{"title":"CVE-2015-0922","description":"McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-01-09 18:59:11","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10095","name":"https://kc.mcafee.com/corporate/index?page=content&id=SB10095","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"McAfee KnowledgeBase - McAfee Security Bulletin - ePO workaround prevents an XML Entity Injection and Metasploit Credential vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/99949","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/99949","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/72298","name":"http://www.securityfocus.com/bid/72298","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"McAfee ePolicy Orchestrator CVE-2015-0922 Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html","name":"http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"McAfee ePolicy Orchestrator Authenticated XXE Credential Exposure ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1031519","name":"http://www.securitytracker.com/id/1031519","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"McAfee ePolicy Orchestrator XML External Entity Flaw and Static Encryption Key Let Remote Authenticated Users Obtain Passwords - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2015/Jan/37","name":"http://seclists.org/fulldisclosure/2015/Jan/37","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: Re: McAfee ePolicy Orchestrator Authenticated XXE and\tCredential Exposure","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://seclists.org/fulldisclosure/2015/Jan/8","name":"http://seclists.org/fulldisclosure/2015/Jan/8","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: McAfee ePolicy Orchestrator Authenticated XXE and Credential\tExposure","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://gist.github.com/brandonprry/692e553975bf29aeaf2c","name":"https://gist.github.com/brandonprry/692e553975bf29aeaf2c","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"gist:692e553975bf29aeaf2c · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0922","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0922","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"922","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mcafee","cpe5":"epolicy_orchestrator","cpe6":"5.0.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"922","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mcafee","cpe5":"epolicy_orchestrator","cpe6":"5.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"922","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mcafee","cpe5":"epolicy_orchestrator","cpe6":"5.1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"922","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mcafee","cpe5":"epolicy_orchestrator","cpe6":"5.1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2015","cve_id":"922","vulnerable":"1","versionEndIncluding":"4.6.8","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mcafee","cpe5":"epolicy_orchestrator","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T04:26:11.339Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"72298","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/72298"},{"name":"20150112 Re: McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2015/Jan/37"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10095"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html"},{"name":"20150106 McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2015/Jan/8"},{"name":"macafee-cve20150922-info-disc(99949)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/99949"},{"name":"1031519","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1031519"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://gist.github.com/brandonprry/692e553975bf29aeaf2c"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-01-06T00:00:00.000Z","descriptions":[{"lang":"en","value":"McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-07T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"72298","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/72298"},{"name":"20150112 Re: McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2015/Jan/37"},{"tags":["x_refsource_CONFIRM"],"url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10095"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html"},{"name":"20150106 McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2015/Jan/8"},{"name":"macafee-cve20150922-info-disc(99949)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/99949"},{"name":"1031519","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1031519"},{"tags":["x_refsource_MISC"],"url":"https://gist.github.com/brandonprry/692e553975bf29aeaf2c"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-0922","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"72298","refsource":"BID","url":"http://www.securityfocus.com/bid/72298"},{"name":"20150112 Re: McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2015/Jan/37"},{"name":"https://kc.mcafee.com/corporate/index?page=content&id=SB10095","refsource":"CONFIRM","url":"https://kc.mcafee.com/corporate/index?page=content&id=SB10095"},{"name":"http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/129827/McAfee-ePolicy-Orchestrator-Authenticated-XXE-Credential-Exposure.html"},{"name":"20150106 McAfee ePolicy Orchestrator Authenticated XXE and Credential Exposure","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2015/Jan/8"},{"name":"macafee-cve20150922-info-disc(99949)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/99949"},{"name":"1031519","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1031519"},{"name":"https://gist.github.com/brandonprry/692e553975bf29aeaf2c","refsource":"MISC","url":"https://gist.github.com/brandonprry/692e553975bf29aeaf2c"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2015-0922","datePublished":"2015-01-09T18:00:00.000Z","dateReserved":"2015-01-09T00:00:00.000Z","dateUpdated":"2024-08-06T04:26:11.339Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-01-09 18:59:11","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*","versionEndIncluding":"4.6.8","matchCriteriaId":"013D7347-100A-454B-997B-E74E65B1C8D7"},{"vulnerable":true,"criteria":"cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.0:*:*:*:*:*:*:*","matchCriteriaId":"BD14FE96-A47F-4C92-90E8-678D93BB4CB3"},{"vulnerable":true,"criteria":"cpe:2.3:a:mcafee:epolicy_orchestrator:5.0.1:*:*:*:*:*:*:*","matchCriteriaId":"648AAB2A-310B-493E-89DF-E8BCA56FB6FD"},{"vulnerable":true,"criteria":"cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:*","matchCriteriaId":"DE33AFB8-9962-4D75-B613-D5032A0949A1"},{"vulnerable":true,"criteria":"cpe:2.3:a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:*","matchCriteriaId":"CEBA52A8-233F-4015-B44B-1BF7B5593CCE"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"922","Ordinal":"1","Title":"CVE-2015-0922","CVE":"CVE-2015-0922","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"922","Ordinal":"1","NoteData":"McAfee ePolicy Orchestrator (ePO) before 4.6.9 and 5.x before 5.1.2 uses the same secret key across different customers' installations, which allows attackers to obtain the administrator password by leveraging knowledge of the encrypted password.","Type":"Description","Title":"CVE-2015-0922"},{"CveYear":"2015","CveId":"922","Ordinal":"2","NoteData":"2015-01-09","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"922","Ordinal":"3","NoteData":"2017-09-07","Type":"Other","Title":"Modified"}]}}}