Vulnerability CVE-2022-0859 - CERT Civis.Net

Vulnerability Name:

CVE-2022-0859 (CCN-222409)

Assigned:

2022-03-22

Published:

2022-03-22

Updated:

2022-03-29

Summary:

McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password.

CVSS v3 Severity:

6.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
5.6 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): High Privileges Required (PR): High User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): High User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

4.4 Medium (CVSS v2 Vector: AV:L/AC:M/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.5 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:M/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): Multiple_Instances
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Data Manipulation

References:

Source: MITRE
Type: CNA
CVE-2022-0859

Source: XF
Type: UNKNOWN
mcafee-cve20220859-sql-injection(222409)

Source: CCN
Type: McAfee Security Bulletin ID: SB10379
ePolicy Orchestrator update addresses multiple product vulnerabilities (CVE-2022-0842, CVE-2022-0857, CVE-2022-0858, CVE-2022-0859, CVE-2022-0861, CVE-2022-0862) and updates Java, Apache HTTP Server, and Tomcat

Source: CONFIRM
Type: Vendor Advisory
https://kc.mcafee.com/corporate/index?page=content&id=SB10379

Vulnerable Configuration:

Configuration 1:

cpe:/a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* (Version < 5.10.0)

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:mcafee:epolicy_orchestrator:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:2.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:2.5:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.6.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:2.5:sp1:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.5.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.6.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:3.0:sp2a:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.5.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.6:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.7:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.8:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.2:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:4.6.9:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.3:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.9.0:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.2:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.3.3:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.9.1:*:*:*:*:*:*:*

OR cpe:/a:mcafee:epolicy_orchestrator:5.1.0:*:*:*:*:*:*:*

Denotes that component is vulnerable