1. Home
  2. CVE Database
  3. CVE-2022-3338
MEDIUM · 5.4

CVE-2022-3338

An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploi...

Vulnerability Description

An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
McafeeEpolicy Orchestrator< 5.10.0

Related Weaknesses (CWE)

CWE-611

References

FAQ

What is CVE-2022-3338?

CVE-2022-3338 is a vulnerability with a CVSS score of 5.4 (MEDIUM). An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploi...

How severe is CVE-2022-3338?

CVE-2022-3338 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-3338?

Check the references section above for vendor advisories and patch information. Affected products include: Mcafee Epolicy Orchestrator.