CVE-2022-3339
Medium
Description
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.
SeverityMedium
CVSS5.4
Exploit probability—
ProductMcafee Epolicy Orchestrator
PublishedOct 18, 2022
First seenOct 18, 2022
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- mcafee epolicy_orchestrator5.10.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mcafee epolicy_orchestrator | v < 5.10.0, 5.10.0 | 5.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.