PT-2023-26959 · Mcafee · Epo

Ben Leonard-Lagarde + 1 · Publicado 2023-07-26 · Atualizado 2023-08-03 · CVE-2023-3946

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ePO versions prior to 5.10 SP1 Update 1

Description A reflected cross-site scripting (XSS) vulnerability allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.

Recommendations For versions prior to 5.10 SP1 Update 1, update to version 5.10 SP1 Update 1 or later to resolve the issue. As a temporary workaround, consider restricting access to links from untrusted sources to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-3946

Produtos afetados

Epo

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-3946 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-3946 · Nota de Segurança
• https://t.me/cibsecurity/67289 · Publicação no Telegram
• https://t.me/cvenotify/55725 · Publicação no Telegram
• https://kcm.trellix.com/corporate/index?page=content&id=SB10402 · Aviso do Fabricante
• https://t.me/cvenotify/55162 · Publicação no Telegram