THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Zendesk (Helpdesk and Chat)

Ok

PUBLISHED

CVE-2024-4844

Reserved:2024-05-13
Published:2024-05-16
Updated:2024-05-16

Description

Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was possible through using a hard coded password for the keystore. Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.



HIGH: 7.5CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-798: Use of Hard-coded Credentials

Product status

Default status
unaffected

All versions below ePO 5.10 Service Pack 1 Update 2
affected

Credits

David Mayer from Neuvik reporter

References

https://thrive.trellix.com/s/article/000013505

cve.org CVE-2024-4844

nvd.nist.gov CVE-2024-4844

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-4844