title: SB10228 ePO Directory Traversal vulnerability
description: Directory Traversal vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.2, 5.3.1, 5.3.0 and 5.9.0 allows administrators to use Windows alternate data streams, which could be used to bypass the file extensions, via not properly validating the path when exporting a particular XML file.
problem types: Directory Traversal vulnerability
affected:
{
product: ePolicy Orchestrator (ePO)
vendor: McAfee
versions:
status: affected, version: 5.3.2
status: affected, version: 5.3.1
status: affected, version: 5.3.0
status: affected, version: 5.9.0
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:L/A:H
version: 3.0
]