CVE-2024-4844
Assigner: trellix
Published: 2024-05-16T06:19:47.418Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: Windows
product: ePolicy Orchestrator
vendor: Trellix
versions: status: affected
version: All versions below ePO 5.10 Service Pack 1 Update 2
credits: type: reporter
value: David Mayer from Neuvik
descriptions: supportingMedia: base64: no
type: text/html
value: Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key.  This was possible through using a hard coded password for the keystore.  Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.
value: Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key.  This was possible through using a hard coded password for the keystore.  Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.
impacts: capecId: CAPEC-554
descriptions: value: CAPEC-554 Functionality Bypass
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-798
description: CWE-798: Use of Hard-coded Credentials
type: CWE
source: discovery: UNKNOWN
x_generator: engine: Vulnogram 0.2.0