CVE-2022-0857CWE-79

ePO Reflected Cross-site scripting vulnerability

Medium · published March 23, 2022

CVSS v3.1
5.4
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00722 · 53.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-03-23T14:15Z
EPSS history
Timeline
  • 23 MAR 14:15Z
    ePO Reflected Cross-site scripting vulnerability
    cvelistv5