title: SB10240 - ePolicy Orchestrator (ePO) - Application Protection Bypass vulnerability
description: Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.
problem types: Application Protection Bypass vulnerability
affected:
{
product: ePolicy Orchestrator (ePO)
vendor: McAfee
versions:
lessThan: 5.3.3 with hotfix EPO5xHF1229850, status: affected, version: 5.3.0 through 5.3.3, versionType: custom
lessThan: 5.9.1 with hotfix EPO5xHF1229850, status: affected, version: 5.9.0 through 5.9.1, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.0
]