CVE-2021-31830

MEDIUM

McAfee Database Security < 4.8.2 - Stored Cross-Site Scripting in Database Name Configuration

Title source: llm
STIX 2.1

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to embed JavaScript code when configuring the name of a database to be monitored. This would be triggered when any authorized user logs into the DBSec interface and opens the properties configuration page for this database.

References (1)

Core 1
Core References
Broken Link, Vendor Advisory x_refsource_confirm
https://kc.mcafee.com/corporate/index?page=content&id=SB10359

Scores

CVSS v3 5.9
EPSS 0.0043
EPSS Percentile 62.4%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Details

CWE
CWE-79
Status published
Products (1)
mcafee/database_security < 4.8.2
Published Jun 03, 2021
Tracked Since Feb 18, 2026