CVE-2022-0858

MEDIUM

McAfee ePolicy Orchestrator < 5.10 Update 13 - Cross-Site Scripting

Title source: llm
STIX 2.1

Description

A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in.

References (1)

Core 1
Core References
Broken Link, Vendor Advisory x_refsource_confirm
https://kc.mcafee.com/corporate/index?page=content&id=SB10379

Scores

CVSS v3 4.3
EPSS 0.0022
EPSS Percentile 44.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
mcafee/epolicy_orchestrator 5.10.0 (13 CPE variants)
mcafee/epolicy_orchestrator < 5.10.0
Published Mar 23, 2022
Tracked Since Feb 18, 2026