Skip to content
OpenAdvisories
High WID-SEC-2023-2963 5 CVEs

Trellix ePolicy Orchestrator: Mehrere Schwachstellen

Published Nov 16, 2023 · Updated Nov 16, 2023 · de-DE

Vendor: Trellix Product: ePolicy Orchestrator < 5.10.0 SP1 UP2 Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Trellix ePolicy Orchestrator ausnutzen, um sich administrative Rechte zu verschaffen, um einen Redirect-Angriff auszuführen und um nicht näher spezifizierte Auswirkungen zu erzielen.

Product

Trellix ePolicy Orchestrator (ePO) zentralisiert und optimiert die Verwaltung der Sicherheit von Endgeräten, Netzwerken und Inhalten.

Vulnerabilities 5

  • High 8.0
    CVE-2023-5444

    CSRF in ePO leading to privilege escalation

    A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new user with administrator privileges to the ePO server. This impacts the dashboard area of the user inte…

    Trellix ePolicy Orchestrator
  • Medium 5.9
    CVE-2023-42794

    Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

    Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service o…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat-coyote Maven
  • Medium 5.4
    CVE-2023-5445

    An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged use…

    Trellix ePolicy Orchestrator
  • Medium 5.3
    CVE-2023-42795

    Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

    Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomc…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2023-45648 Scanner template

    Apache Tomcat: Trailer header parsing too lenient

    Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, in…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven

Revision history

  1. #1

    Initiale Fassung

References