medium6.5Public exploit code
CVE-2013-4882
Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA) 4.5…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- McAfee ePO 4.6.6 - Multiple Vulnerabilities2013-07-13 · webapps · windows
Impact
Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA) 4.5 and 4.6, allow remote authenticated users to execute arbitrary SQL commands via the uid parameter to (1) core/showRegisteredTypeDetails.do and (2) EPOAGENTMETA/DisplayMSAPropsDetail.do, a different vulnerability than CVE-2013-0140.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mcafee | Epolicy Orchestrator | through 4.6.6 Versions 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4 |
| Mcafee | Epolicy Orchestrator Agent | Versions 4.5, 4.6 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/archive/1/527228
- http://www.securitytracker.com/id/1028803
- https://kc.mcafee.com/corporate/index?page=content&id=SB10043
- http://www.securityfocus.com/archive/1/527228
- http://www.securitytracker.com/id/1028803
- https://kc.mcafee.com/corporate/index?page=content&id=SB10043