What’s Vulnerable › Vulnerabilities

CVE-2023-5445

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-17 · updated 2026-06-17
• Weakness: CWE-601

Description

An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the purpose of redirecting URL request(s) to a malicious site. This impacts the dashboard area of the user interface. A user would need to be logged into ePO to trigger this vulnerability. To exploit this the attacker must change the HTTP payload post submission, prior to it reaching the ePO server.

Affected products

• McAfee,LLC McAfee ePolicy Orchestrator (ePO): before 5.10.0; 5.10.0-service_pack_1_update, 5.10.0-service_pack_1_update_1, 5.10.0-update_1, 5.10.0-update_10, 5.10.0-update_11, 5.10.0-update_11_hotfix_1 (+13) — fixed in 5.10.0

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee ePolicy Orchestrator (ePO) 5.10.0. Check the vendor advisory for mitigations.

References

• https://kcm.trellix.com/corporate/index?page=content&id=SB10410
• https://kcm.trellix.com/corporate/index?page=content&id=SB10410

Get alerted when CVE-2023-5445 or the next vulnerability affects your stack