CVE-2016-8027

🗓️ 14 Mar 2017 22:00:00Reported by intelType

cve🔗 web.nvd.nist.gov👁 61 Views🌐 WEB

SQL injection vulnerability in McAfee ePO 5.3.2 and earlier allows attackers to alter SQL query leading to info disclosure or agent impersonation via crafted HTTP post

Reporter	Title	Published	Views	Family All 10
CNVD	McAfee ePolicy Orchestrator SQL Injection Vulnerability (CNVD-2017-01459)	10 Feb 201700:00	–	cnvd
Check Point Advisories	McAfee ePolicy Orchestrator DataChannel GUID SQL Injection (CVE-2016-8027)	22 Mar 201700:00	–	checkpoint_advisories
Cvelist	CVE-2016-8027	14 Mar 201722:00	–	cvelist
Tenable Nessus	McAfee ePolicy Orchestrator 5.1.x < 5.1.3 HF1167014 / 5.3.x < 5.3.1 HF1179709 / 5.3.x < 5.3.2 HF1167013 Blind SQL Injection (SB10187)	23 Feb 201700:00	–	nessus
NVD	CVE-2016-8027	14 Mar 201722:59	–	nvd
OpenVAS	McAfee ePolicy Orchestrator SQL Injection Vulnerability	22 Mar 201700:00	–	openvas
OSV	CVE-2016-8027	14 Mar 201722:59	–	osv
Prion	Sql injection	14 Mar 201722:59	–	prion
seebug.org	McAfee ePolicy Orchestrator DataChannel Blind SQL Injection Vulnerability(CVE-2016-8027)	26 Sep 201700:00	–	seebug
Talos	McAfee ePolicy Orchestrator DataChannel Blind SQL Injection Vulnerability	1 Feb 201700:00	–	talos

NVD

Node

mcafee epolicy_orchestratorRange5.1.0–5.1.3

mcafee epolicy_orchestratorRange5.3.0–5.3.2

[
  {
    "product": "McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier"
      }
    ]
  }
]

Source	Link
kc	www.kc.mcafee.com/corporate/index
securitytracker	www.securitytracker.com/id/1037777
securityfocus	www.securityfocus.com/bid/95981

Parameter	Position	Path	Description	CWE
AgentGUID	request body	receiveDataChannelMsg.dcp	SQL injection via AgentGUID in data channel processing leading to potential information disclosure or impersonation	CWE-89
AgentGUID	request body	dcRedirect/dataChannelMsg.dc	SQL injection via forwarded data channel message handling	CWE-89

17 Jun 2026 00:53Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 310

EPSS0.05749

CWE-89