---
id: 5126
title: "Vulnerabilities in McAfee ePolicy Orchestrator"
source_domain: swarm.ptsecurity.com
source_url: "https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/"
published_at: "2020-12-07T13:52:53Z"
tags: ["rce", "vulnerability-research", "cve", "ssrf", "mcafee"]
phying_url: "https://phying.com/item/5126"
lang: en
---

# Vulnerabilities in McAfee ePolicy Orchestrator

## Summary

Three McAfee ePolicy Orchestrator 5.10.0 vulnerabilities: a CSRF + SSRF + MITM chain enabling unauthenticated RCE by rewriting database test-connection traffic to reset the sa password, a ZipSlip RCE for logged-in users, and reflected XSS.

## Intelligence Metadata

- **Sources:** swarm.ptsecurity.com
- **Published:** 2020-12-07T13:52:53Z
- **Original:** https://swarm.ptsecurity.com/vulnerabilities-in-mcafee-epolicy-orchestrator/
- **Phying News:** https://phying.com/item/5126