PT-2021-15590 · Mcafee · Mcafee Epolicy Orchestrator

Published 2021-03-26 · Updated 2023-12-23 · CVE-2021-23888

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: McAfee ePolicy Orchestrator versions prior to 5.10 Update 10

Description: The issue is related to an unvalidated client-side URL redirect, which could allow an authenticated user to load an untrusted site in an ePO iframe, potentially leading to information theft from the authenticated user.

Recommendations: For versions prior to 5.10 Update 10, update to version 5.10 Update 10 or later to resolve the issue. As a temporary workaround, consider restricting access to iframes within the ePO application to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-23888

Affected Products

Mcafee Epolicy Orchestrator

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2021-23888 · Security Note
• https://osv.dev/vulnerability/CVE-2021-23888 · Vendor Advisory
• https://github.com/ztgrace/mole · Note
• https://t.me/cvenotify/12018 · Telegram Post
• https://t.me/canyoupwnme/6725 · Telegram Post
• https://twitter.com/buaqbot/status/1738776680141832321 · Twitter Post
• https://t.me/thebugbountyhunter/5270 · Telegram Post
• https://t.me/ckure/7386 · Telegram Post
• https://kc.mcafee.com/corporate/index?page=content&id=SB10352 · Note
• https://t.me/cvenotify/12040 · Telegram Post
• https://t.me/cvenotify/12340 · Telegram Post
• https://t.me/secharvester/10808 · Telegram Post
• https://t.me/defcon_news/72393 · Telegram Post
• https://t.me/rnetsec/14688 · Telegram Post
• https://t.me/cybersecuritytechnologies/3002 · Telegram Post