PT-2021-19537 · Mcafee · Mcafee Epolicy Orchestrator

Published 2021-10-22 · Updated 2023-11-15 · CVE-2021-31835

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions McAfee ePolicy Orchestrator (ePO) versions prior to 5.10 Update 11

Description The issue allows ePO administrators to inject arbitrary web script or HTML via a specific parameter where the administrator's entries were not correctly sanitized. This is a Cross-Site Scripting issue.

Recommendations For versions prior to 5.10 Update 11, update to version 5.10 Update 11 or later to resolve the issue. As a temporary workaround, consider restricting the ability of ePO administrators to inject arbitrary web script or HTML via the specific vulnerable parameter until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-31835

Affected Products

Mcafee Epolicy Orchestrator

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-31835 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31835 · Vendor Advisory
• https://t.me/cibsecurity/31001 · Telegram Post
• https://kc.mcafee.com/corporate/index?page=content&id=SB10366 · Note