CVSS 3.1 Score 8.0 of 10 (high)


Published Nov 17, 2023
Updated: Nov 29, 2023
CWE ID 352


CVE-2023-5444 is a Cross Site Request Forgery vulnerability that affects ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, an enterprise security management platform. This vulnerability allows a remote low privilege user to add a new user with administrator privileges to the ePO server through the dashboard area of the user interface. To exploit this vulnerability, the attacker needs to modify the HTTP payload post submission before it reaches the ePO server. The potential danger of this vulnerability is that it allows unauthorized users to gain administrative access to the ePO server, potentially compromising sensitive data and system integrity. It is recommended to update ePolicy Orchestrator to version 5.10.0 CP1 Update 2 or later to remediate this vulnerability and ensure system security.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-5444 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options