RETIRED: McAfee ePolicy Orchestrator Multiple SQL Injection and Cross Site Scripting Vulnerabilities
BID:61145
Info
RETIRED: McAfee ePolicy Orchestrator Multiple SQL Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 61145 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 12 2013 12:00AM |
| Updated: | Jul 24 2013 11:04PM |
| Credit: | Nuri Fattah of NATO / NCIRC |
| Vulnerable: |
McAfee ePolicy Orchestrator (ePO) 4.5 |
| Not Vulnerable: | |
Discussion
RETIRED: McAfee ePolicy Orchestrator Multiple SQL Injection and Cross Site Scripting Vulnerabilities
McAfee ePolicy Orchestrator is prone to multiple SQL-injection and cross-site scripting vulnerabilities.
Successful exploits could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
McAfee ePolicy Orchestrator 4.6.6 is vulnerable; other versions may also be affected.
This BID is being retired. The following individual records exist to better document the issues:
61421 McAfee ePolicy Orchestrator Multiple SQL Injection Vulnerabilities
61422 McAfee ePolicy Orchestrator Multiple Cross Site Scripting Vulnerabilities
McAfee ePolicy Orchestrator is prone to multiple SQL-injection and cross-site scripting vulnerabilities.
Successful exploits could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
McAfee ePolicy Orchestrator 4.6.6 is vulnerable; other versions may also be affected.
This BID is being retired. The following individual records exist to better document the issues:
61421 McAfee ePolicy Orchestrator Multiple SQL Injection Vulnerabilities
61422 McAfee ePolicy Orchestrator Multiple Cross Site Scripting Vulnerabilities
Exploit / POC
RETIRED: McAfee ePolicy Orchestrator Multiple SQL Injection and Cross Site Scripting Vulnerabilities
Attackers can use a browser to exploit the SQL-injection issues. An attacker must trick a victim into following a malicious URI to exploit cross-site scripting issues.
The following example URIs are available:
Attackers can use a browser to exploit the SQL-injection issues. An attacker must trick a victim into following a malicious URI to exploit cross-site scripting issues.
The following example URIs are available:
Solution / Fix
RETIRED: McAfee ePolicy Orchestrator Multiple SQL Injection and Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.