Vulnerability CVE-2022-0842 - CERT Civis.Net

Vulnerability Name:

CVE-2022-0842 (CCN-222412)

Assigned:

2022-03-22

Published:

2022-03-22

Updated:

2022-03-29

Summary:

A blind SQL injection vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote authenticated attacker to potentially obtain information from the ePO database. The data obtained is dependent on the privileges the attacker has and to obtain sensitive data the attacker would require administrator privileges.

CVSS v3 Severity:

4.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
4.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

5.4 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N)
4.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): High User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

4.6 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:M/C:C/I:N/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): Multiple_Instances
Impact Metrics:	Confidentiality (C): Complete Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Data Manipulation

References:

Source: MITRE
Type: CNA
CVE-2022-0842

Source: XF
Type: UNKNOWN
mcafee-cve20220842-sql-injection(222412)

Source: CCN
Type: McAfee Security Bulletin ID: SB10379
ePolicy Orchestrator update addresses multiple product vulnerabilities (CVE-2022-0842, CVE-2022-0857, CVE-2022-0858, CVE-2022-0859, CVE-2022-0861, CVE-2022-0862) and updates Java, Apache HTTP Server, and Tomcat

Source: CONFIRM
Type: Vendor Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10379

Vulnerable Configuration:

Configuration 1:

cpe:/a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* (Version < 5.10.0)

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:mcafee:epolicy_orchestrator:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:2.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:2.5:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.6.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:2.5:sp1:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.5.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.6.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.0:sp2a:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.5.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.6:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.7:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.8:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.2:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.9:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.3:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.2:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.3:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:*

Denotes that component is vulnerable