title: McAfee ePolicy Orchestrator (ePO) - OS Command Injection vulnerability
description: OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output.
problem types: OS Command Injection vulnerability
affected:
{
platforms: x86
product: ePolicy Orchestrator (ePO)
vendor: McAfee
versions:
lessThan: 5.3.3, status: affected, version: 5.1, versionType: custom
lessThan: 5.3.3, status: affected, version: 5.3, versionType: custom
lessThan: 5.9.1, status: affected, version: 5.9, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.0
]