Vulnerability CVE-2022-0858 - CERT Civis.Net

Vulnerability Name:

CVE-2022-0858 (CCN-222410)

Assigned:

2022-03-22

Published:

2022-03-22

Updated:

2022-03-29

Summary:

A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in.

CVSS v3 Severity:

6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.3 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): None

4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Cross-Site Scripting

References:

Source: MITRE
Type: CNA
CVE-2022-0858

Source: XF
Type: UNKNOWN
mcafee-cve20220858-xss(222410)

Source: CCN
Type: McAfee Security Bulletin ID: SB10379
ePolicy Orchestrator update addresses multiple product vulnerabilities (CVE-2022-0842, CVE-2022-0857, CVE-2022-0858, CVE-2022-0859, CVE-2022-0861, CVE-2022-0862) and updates Java, Apache HTTP Server, and Tomcat

Source: CONFIRM
Type: Vendor Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10379

Vulnerable Configuration:

Configuration 1:

cpe:/a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* (Version < 5.10.0)

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:mcafee:epolicy_orchestrator:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:2.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:2.5:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.6.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:2.5:sp1:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.5.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.6.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.0:sp2a:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.5.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.6:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.7:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.8:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.2:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.9:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.3:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.2:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.3:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:*

Denotes that component is vulnerable