The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add dashboards to read arbitrary files by importing a crafted XML file, related to an XML External Entity (XXE) issue.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Epolicy_orchestrator | Mcafee | 4.6.0 | 4.6.0 |
| Epolicy_orchestrator | Mcafee | 4.6.5 | 4.6.5 |
| Epolicy_orchestrator | Mcafee | 4.6.3 | 4.6.3 |
| Epolicy_orchestrator | Mcafee | * | 4.6.7 |
| Epolicy_orchestrator | Mcafee | 4.6.2 | 4.6.2 |
| Epolicy_orchestrator | Mcafee | 4.6.4 | 4.6.4 |
| Epolicy_orchestrator | Mcafee | 4.6.6 | 4.6.6 |
| Epolicy_orchestrator | Mcafee | 4.6.1 | 4.6.1 |