CVE-2022-3338 — XXE in Trellix ePO server
An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery att…
Published: 2022-10-18 · CVSS: 5.4 · CVSS 3.1
An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7