PT-2023-26959 · Mcafee · Epo

Ben Leonard-Lagarde + 1 · Published 2023-07-26 · Updated 2023-08-03 · CVE-2023-3946

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ePO versions prior to 5.10 SP1 Update 1

Description A reflected cross-site scripting (XSS) vulnerability allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.

Recommendations For versions prior to 5.10 SP1 Update 1, update to version 5.10 SP1 Update 1 or later to resolve the issue. As a temporary workaround, consider restricting access to links from untrusted sources to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-3946

Affected Products

Epo

References · 6

• https://osv.dev/vulnerability/CVE-2023-3946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3946 · Security Note
• https://kcm.trellix.com/corporate/index?page=content&id=SB10402 · Vendor Advisory
• https://t.me/cibsecurity/67289 · Telegram Post
• https://t.me/cvenotify/55725 · Telegram Post
• https://t.me/cvenotify/55162 · Telegram Post