Intrusion PreventionMcAfee.ePolicy.Orchestrator.XML.Entity.Injection
Description
This indicates an attack attempt against an XML External Entity (XXE) vulnerability in McAfee ePolicy Orchestrator.
The vulnerability is due to an improper validation of users supplied data while the affected application handles a crafted XML file. A remote attacker can exploit this to gain unauthorized access to sensitive information via a crafted XML file.
Affected Products
McAfee ePolicy Orchestrator prior to 4.6.9
McAfee ePolicy Orchestrator prior to 5.1.2
Impact
Information Disclosure: Remote attackers can gain sensitive information from vulnerable systems.
Recommended Actions
Apply the most recent upgrade or patch from the vendor.
https://kc.mcafee.com/corporate/index?page=content&id=SB10095&actp=null&viewlocale=en_US&showDraft=false&platinum_status=false&locale=en_US
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 40017 |
| Created | Feb 17, 2015 |
| Updated | Nov 15, 2021 |
| Risk |
|
| CVE ID | CVE-2015-0921 |
| Exploit Prediction Score | 2.65% |
| Default Action | drop |
| Active | |
| Affected OS | Windows |
| Affected App | Other |