PT-2021-19536 · Mcafee · Mcafee Epolicy Orchestrator

CVE-2021-31834 · Published 2021-10-22 · Updated 2023-11-15

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator (ePO) versions prior to 5.10 Update 11

Description The issue allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. This is a Stored Cross-Site Scripting vulnerability.

Recommendations For versions prior to 5.10 Update 11, update to version 5.10 Update 11 or later to resolve the issue. As a temporary workaround, consider restricting the input of administrators to prevent arbitrary web script or HTML injection until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-31834

Affected Products

Mcafee Epolicy Orchestrator

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-31834 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31834 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SB10366 · Note
• https://t.me/cibsecurity/31002 · Telegram Post