McAfee ePolicy Orchestrator 'conditionXML' Parameter XML External Entity Injection Vulnerability

Bugtraq ID:	71881
Class:	Design Error
CVE:	CVE-2015-0921
Remote:	Yes
Local:	No
Published:	Jan 06 2015 12:00AM
Updated:	Jan 28 2015 12:02AM
Credit:	Brandon Perry
Vulnerable:	McAfee ePolicy Orchestrator 3.7 McAfee ePolicy Orchestrator 3.6.1 Patch 4 McAfee ePolicy Orchestrator 3.6.1 patch 1 McAfee ePolicy Orchestrator 3.6.1 McAfee ePolicy Orchestrator 3.6 patch 5 McAfee ePolicy Orchestrator 3.6 McAfee ePolicy Orchestrator 3.5.5 .438 McAfee ePolicy Orchestrator 3.5.5 McAfee ePolicy Orchestrator 3.5 patch 7 McAfee ePolicy Orchestrator 3.0 SP2a McAfee ePolicy Orchestrator 3.0 McAfee ePolicy Orchestrator 2.5.1 McAfee ePolicy Orchestrator 2.5 SP1 McAfee ePolicy Orchestrator 2.5 McAfee ePolicy Orchestrator 2.0 McAfee ePolicy Orchestrator 1.1 McAfee ePolicy Orchestrator 1.0 McAfee ePolicy Orchestrator 4.0 McAfee ePolicy Orchestrator 3.5 patch 6 McAfee ePolicy Orchestrator 3.5 patch 5 McAfee ePolicy Orchestrator 3.5
Not Vulnerable:

McAfee ePolicy Orchestrator 'conditionXML' Parameter XML External Entity Injection Vulnerability

McAfee ePolicy Orchestrator is prone to an XML External Entity injection vulnerability.

An attacker can exploit this issue to gain access to sensitive information from the application; this may lead to further attacks.

McAfee ePolicy Orchestrator 'conditionXML' Parameter XML External Entity Injection Vulnerability

The following metasploit exploit module is available:

• /data/vulnerabilities/exploits/71881.rb

McAfee ePolicy Orchestrator 'conditionXML' Parameter XML External Entity Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

McAfee ePolicy Orchestrator 'conditionXML' Parameter XML External Entity Injection Vulnerability

References:

• ePolicy Orchestrator Product Page (McAfee)