Read the docs
TI-2023-05011 Aliases CVE-2023-5444GHSA-qvh3-87rf-gc36

CSRF in ePO leading to privilege escalation

Priority LOW 37CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.

Summary

A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new user with administrator privileges to the ePO server. This impacts the dashboard area of the user interface. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00351 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TrellixePolicy OrchestratorPrior to 5.10.0 SP1 UP2—No fix listedCNA
  • ePolicy Orchestrator VendorTrellix Affected Prior to 5.10.0 SP1 UP2 Fixed in — No fix listed CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*before 5.10.0VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:service_pack_1_update:*:*:*:*:*:*5.10.0 service_pack_1_updateVulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:service_pack_1_update_1:*:*:*:*:*:*5.10.0 service_pack_1_update_1VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*5.10.0 update_1VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*5.10.0 update_10VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:*5.10.0 update_11VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11_hotfix_1:*:*:*:*:*:*5.10.0 update_11_hotfix_1VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11_hotfix_2:*:*:*:*:*:*5.10.0 update_11_hotfix_2VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:*5.10.0 update_12VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_13:*:*:*:*:*:*5.10.0 update_13VulnerableMcAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* Versions before 5.10.0 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:service_pack_1_update:*:*:*:*:*:* Versions 5.10.0 service_pack_1_update Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:service_pack_1_update_1:*:*:*:*:*:* Versions 5.10.0 service_pack_1_update_1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:* Versions 5.10.0 update_1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:* Versions 5.10.0 update_10 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:* Versions 5.10.0 update_11 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11_hotfix_1:*:*:*:*:*:* Versions 5.10.0 update_11_hotfix_1 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11_hotfix_2:*:*:*:*:*:* Versions 5.10.0 update_11_hotfix_2 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:* Versions 5.10.0 update_12 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_13:*:*:*:*:*:* Versions 5.10.0 update_13 Vulnerable ·McAfee
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_14:*:*:*:*:*:*5.10.0 update_14VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_15:*:*:*:*:*:*5.10.0 update_15VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*5.10.0 update_2VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*5.10.0 update_3VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*5.10.0 update_4VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*5.10.0 update_5VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*5.10.0 update_6VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*5.10.0 update_7VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*5.10.0 update_8VulnerableMcAfee
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*5.10.0 update_9VulnerableMcAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_14:*:*:*:*:*:* Versions 5.10.0 update_14 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_15:*:*:*:*:*:* Versions 5.10.0 update_15 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:* Versions 5.10.0 update_2 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:* Versions 5.10.0 update_3 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:* Versions 5.10.0 update_4 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:* Versions 5.10.0 update_5 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:* Versions 5.10.0 update_6 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:* Versions 5.10.0 update_7 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:* Versions 5.10.0 update_8 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:* Versions 5.10.0 update_9 Vulnerable ·McAfee

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-5444
  2. 2026-10-03 Alias added: GHSA-qvh3-87rf-gc36

References

Other 1

  • TI-2024-10633 OS command injection in Trellix Enterprise Security Manager CVSS 3.1CRITICAL 9.8
  • TI-2024-05266 Deserialization of untrusted data in Trellix Intrusion Prevention System Manager CVSS 3.1CRITICAL 9.8
  • TI-2024-10632 Path traversal in Trellix Enterprise Security Manager CVSS 3.1HIGH 8.2
  • TI-2023-05589 Command injection in Trellix ESM CVSS 3.1HIGH 8.4
  • TI-2023-03101 OS command injection in Trellix Enterprise Security Manager CVSS 3.1HIGH 8.8
  • TI-2023-05161 Path traversal in Trellix Application and Change Control CVSS 3.1HIGH 8.4
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences