CVE-2021-31851
Medium
Description
A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extraction of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests.
SeverityMedium
CVSS6.1
Exploit probability—
ProductMcafee Policy Auditor
PublishedNov 23, 2021
First seenNov 23, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- mcafee policy_auditor6.5.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mcafee policy_auditor | v < 6.5.2 | 6.5.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.