CVE-2023-5444

Summary

CVE-2023-5444 is a Cross Site Request Forgery vulnerability that affects ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, an enterprise security management platform. This vulnerability allows a remote low privilege user to add a new user with administrator privileges to the ePO server through the dashboard area of the user interface. To exploit this vulnerability, the attacker needs to modify the HTTP payload post submission before it reaches the ePO server. The potential danger of this vulnerability is that it allows unauthorized users to gain administrative access to the ePO server, potentially compromising sensitive data and system integrity. It is recommended to update ePolicy Orchestrator to version 5.10.0 CP1 Update 2 or later to remediate this vulnerability and ensure system security.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.