CVE-2022-0858CWE-79

Cross-site scripting vulnerability in ePO

Medium · published March 23, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
56.5
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00812 · 56.5th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2022-03-23T14:20Z
EPSS history
Timeline
  • 23 MAR 14:20Z
    Cross-site scripting vulnerability in ePO
    cvelistv5