CVE-2021-31834

MEDIUM

McAfee ePolicy Orchestrator < 5.10.0 Update 11 - Stored Cross-Site Scripting via Administrator Input Parameters

Title source: llm
STIX 2.1

Description

Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.

References (1)

Core 1
Core References

Scores

CVSS v3 5.4
EPSS 0.0021
EPSS Percentile 42.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
mcafee/epolicy_orchestrator 5.10.0 (11 CPE variants)
mcafee/epolicy_orchestrator < 5.10.0
Published Oct 22, 2021
Tracked Since Feb 18, 2026