CVE-2024-4844 Hardcoded credentials in ePolicy Orchestrator
An admin on the ePO server can read the keystore file using a hardcoded password to access the database encryption key.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-4844?
CVE-2024-4844 is a high-severity vulnerability in Trellix ePolicy Orchestrator, published on 16 May 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was possible through using a hard coded password for the keystore. Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.
Weakness: CWE-798
Which versions are affected by CVE-2024-4844?
How do I fix CVE-2024-4844?
No fix has been published for CVE-2024-4844 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-4844 being exploited?
There is no known exploitation of CVE-2024-4844 in the wild and no public exploit code.
Sources
Also known as GHSA-w3xx-8whh-c3rq.