Read the docs
TI-2018-04915 Aliases CVE-2018-6672GHSA-4q27-f9mh-jgq2

SB10240 - ePolicy Orchestrator (ePO) - Information disclosure vulnerablity

Priority LOW 31CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Information disclosure vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows authenticated users to view sensitive information in plain text format via unspecified vectors.

Why it matters now

EPSS 0.01201 68th percentileScored 2026-11-07
Fix Fixed ePolicy Orchestrator (ePO) (McAfee): 5.3.3 with hotfix EPO5xHF1229850, 5.9.1 with hotfix EPO5xHF1229850

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeePolicy Orchestrator (ePO)5.3.0 through 5.3.3 to before 5.3.3 with hotfix EPO5xHF1229850; 5.9.0 through 5.9.1 to before 5.9.1 with hotfix EPO5xHF12298505.3.3 with hotfix EPO5xHF1229850, 5.9.1 with hotfix EPO5xHF1229850Patch availableCNA
  • ePolicy Orchestrator (ePO) VendorMcAfee Affected 5.3.0 through 5.3.3 to before 5.3.3 with hotfix EPO5xHF1229850; 5.9.0 through 5.9.1 to before 5.9.1 with hotfix EPO5xHF1229850 Fixed in 5.3.3 with hotfix EPO5xHF1229850, 5.9.1 with hotfix EPO5xHF1229850 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*5.3.0 – 5.3.3; 5.9.0 – 5.9.1VulnerableMcAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* Versions 5.3.0 – 5.3.3; 5.9.0 – 5.9.1 Vulnerable ·McAfee

Remediation

  • Fix · CNA ePolicy Orchestrator (ePO) (McAfee) Fixed in 5.3.3 with hotfix EPO5xHF1229850, 5.9.1 with hotfix EPO5xHF1229850

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    McAfee ePolicy Orchestrator (ePO) 5.3.3 with hotfix EPO5xHF1229850, 5.9.1 with hotfix EPO5xHF1229850

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2018-04914 SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerabilityPriority LOW 34
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-6672
  2. 2026-10-03 Alias added: GHSA-4q27-f9mh-jgq2

References

Other 1

  • TI-2020-10912 Infinite loop in Apache Tomcat CVSS 3.1HIGH 7.5
  • TI-2006-04972 Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot… CVSS 2.0HIGH 10.0
  • TI-2021-06204 Integer overflow in CipherUpdate CVSS 3.1HIGH 7.5
  • TI-2021-12641 Incorrect Transfer-Encoding handling with HTTP/1.0 CVSS 3.1MEDIUM 5.3
  • TI-2020-07593 Deserialization of untrusted data in Apache Tomcat CVSS 3.1HIGH 7.0
  • TI-2021-02646 Read buffer overruns processing ASN.1 strings CVSS 3.1HIGH 7.4
See all 85 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences