CVE-2014-2205

Severity: medium (CVSS 6.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-02-26 · updated 2026-06-17
Weakness: CWE-264

Description

The Import and Export Framework in McAfee ePolicy Orchestrator (ePO) before 4.6.7 Hotfix 940148 allows remote authenticated users with permissions to add dashboards to read arbitrary files by importing a crafted XML file, related to an XML External Entity (XXE) issue.

Affected products

McAfee,LLC McAfee ePolicy Orchestrator (ePO): through 4.6.7; 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4, 4.6.5 (+1)

References

http://secunia.com/advisories/57114
http://www.securityfocus.com/archive/1/531255/100/0/threaded
http://www.securityfocus.com/bid/65771
https://kc.mcafee.com/corporate/index?page=content&id=SB10065
https://www.redteam-pentesting.de/advisories/rt-sa-2014-001.txt
http://secunia.com/advisories/57114
http://www.securityfocus.com/archive/1/531255/100/0/threaded
http://www.securityfocus.com/bid/65771
https://kc.mcafee.com/corporate/index?page=content&id=SB10065
https://www.redteam-pentesting.de/advisories/rt-sa-2014-001.txt

Get alerted when CVE-2014-2205 or the next vulnerability affects your stack