TrellixCVELIST:CVE-2022-3338CVE-2022-3338 XXE in Trellix ePO server
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
46.9%
An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API.
CNA Affected
[
{
"vendor": "Trellix",
"product": "Trellix ePolicy Orchestrator (ePO)",
"versions": [
{
"version": "unspecified",
"lessThan": "5.10 Update 14",
"status": "affected",
"versionType": "custom"
}
]
}
]Related
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
46.9%