CVE-2013-4882 in ePolicy Orchestrator
Summary
by MITRE
Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA) 4.5 and 4.6, allow remote authenticated users to execute arbitrary SQL commands via the uid parameter to (1) core/showRegisteredTypeDetails.do and (2) EPOAGENTMETA/DisplayMSAPropsDetail.do, a different vulnerability than CVE-2013-0140.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/06/2025
The vulnerability CVE-2013-4882 represents a critical SQL injection flaw affecting McAfee ePolicy Orchestrator versions 4.6.6 and earlier, along with the ePO extension for McAfee Agent versions 4.5 and 4.6. This vulnerability resides in the authentication and authorization mechanisms of the ePolicy Orchestrator platform, which serves as a centralized security management solution for enterprise environments. The flaw specifically manifests when processing user input through the uid parameter in two distinct endpoints: core/showRegisteredTypeDetails.do and EPOAGENTMETA/DisplayMSAPropsDetail.do, making it particularly dangerous as it affects core operational functionality of the security management infrastructure.
The technical implementation of this vulnerability stems from improper input validation and sanitization within the web application layer of ePolicy Orchestrator. When authenticated users submit maliciously crafted uid parameters to the affected endpoints, the application fails to properly escape or filter special SQL characters and commands before incorporating them into database queries. This allows attackers to inject arbitrary SQL commands that execute within the context of the database connection, effectively bypassing the application's security controls. The vulnerability is classified as a CWE-89 SQL Injection weakness, which according to the Common Weakness Enumeration taxonomy represents one of the most prevalent and dangerous web application security flaws. The attack vector requires only authenticated access, making it particularly concerning as it can be exploited by malicious insiders or compromised legitimate users.
The operational impact of CVE-2013-4882 extends far beyond simple data theft, as successful exploitation could enable attackers to gain complete control over the database backend hosting critical security policy information, user credentials, and system configurations. Organizations using ePolicy Orchestrator as their primary security management platform face potential compromise of their entire security infrastructure, including the ability to manipulate security policies, escalate privileges, and access sensitive enterprise data. The vulnerability's classification under ATT&CK technique T1078 Valid Accounts indicates that it leverages legitimate authentication mechanisms to achieve persistence and privilege escalation. Furthermore, the exploitation could lead to data exfiltration, system compromise, and disruption of security operations that depend on the integrity of the ePolicy Orchestrator platform.
Mitigation strategies for CVE-2013-4882 should prioritize immediate patching of affected systems to version 4.6.7 or later, which contains the necessary security fixes. Organizations should also implement network segmentation and access controls to limit exposure of the vulnerable endpoints to only authorized administrative users. The implementation of web application firewalls and input validation measures can provide additional defense-in-depth layers. Security monitoring should be enhanced to detect unusual database query patterns and unauthorized access attempts. Additionally, organizations should conduct comprehensive security assessments of their ePolicy Orchestrator installations, review access controls and user permissions, and implement principle of least privilege for administrative accounts. The vulnerability underscores the importance of regular security updates and the need for proper input validation in enterprise security management platforms.