A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-0861
• https://kc.mcafee.com/corporate/index?page=content&id=SB10379