CVE-2022-0859

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Mar 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-08609.1Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.CVE-2022-08613.8A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator at CVE-2022-08625.3A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update CVE-2022-08637.2The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like CVE-2022-08646.1The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before ou CVE-2022-08656.5Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile CVE-2022-08665.3This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configur CVE-2022-08679.8The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolate CVE-2022-08686.1Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.CVE-2022-08696.1Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.CVE-2022-08705.3Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.CVE-2022-08719.1Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.