CVE-2022-3338
Assigner: trellix
Published: 2022-10-18T00:00:00
State: PUBLISHED
title: XXE in Trellix ePO server
descriptions: value: An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API.
affected: vendor: Trellix
product: Trellix ePolicy Orchestrator (ePO)
versions: version: unspecified
lessThan: 5.10 Update 14
status: affected
versionType: custom
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
problemTypes: descriptions: type: CWE
description: CWE-611: Improper Restriction of XML External Entity Reference
cweId: CWE-611
x_generator: engine: Vulnogram 0.0.9
source: discovery: EXTERNAL