CVE-2021-23889

LOW

McAfee ePolicy Orchestrator < 5.10.0 - Authenticated Stored Cross-Site Scripting via Multiple Parameters

Title source: llm
STIX 2.1

Description

Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.

References (1)

Core 1
Core References

Scores

CVSS v3 3.5
EPSS 0.0021
EPSS Percentile 43.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
mcafee/epolicy_orchestrator 5.10.0 (10 CPE variants)
mcafee/epolicy_orchestrator < 5.10.0
Published Mar 26, 2021
Tracked Since Feb 18, 2026