McAfee ePolicy Orchestrator CVE-2015-0922 Information Disclosure Vulnerability

Bugtraq ID:	72298
Class:	Design Error
CVE:	CVE-2015-0922
Remote:	Yes
Local:	No
Published:	Jan 23 2015 12:00AM
Updated:	Jan 23 2015 12:00AM
Credit:	Brandon Perry
Vulnerable:	McAfee ePolicy Orchestrator 3.7 McAfee ePolicy Orchestrator 3.6.1 Patch 4 McAfee ePolicy Orchestrator 3.6.1 patch 1 McAfee ePolicy Orchestrator 3.6.1 McAfee ePolicy Orchestrator 3.6 patch 5 McAfee ePolicy Orchestrator 3.6 McAfee ePolicy Orchestrator 3.5.5 .438 McAfee ePolicy Orchestrator 3.5.5 McAfee ePolicy Orchestrator 3.5 patch 7 McAfee ePolicy Orchestrator 3.0 SP2a McAfee ePolicy Orchestrator 3.0 McAfee ePolicy Orchestrator 2.5.1 McAfee ePolicy Orchestrator 2.5 SP1 McAfee ePolicy Orchestrator 2.5 McAfee ePolicy Orchestrator 2.0 McAfee ePolicy Orchestrator 1.1 McAfee ePolicy Orchestrator 1.0 McAfee ePolicy Orchestrator 4.0 McAfee ePolicy Orchestrator 3.5 patch 6 McAfee ePolicy Orchestrator 3.5 patch 5 McAfee ePolicy Orchestrator 3.5
Not Vulnerable:

McAfee ePolicy Orchestrator CVE-2015-0922 Information Disclosure Vulnerability

McAfee ePolicy Orchestrator is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to gain access to sensitive information from the application; this may lead to further attacks.

McAfee ePolicy Orchestrator CVE-2015-0922 Information Disclosure Vulnerability

The following metasploit exploit module is available:

• /data/vulnerabilities/exploits/72298.rb

McAfee ePolicy Orchestrator CVE-2015-0922 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

McAfee ePolicy Orchestrator CVE-2015-0922 Information Disclosure Vulnerability

References:

• ePolicy Orchestrator Product Page (McAfee)