CVE-2021-23889 Vulnerability Details

  /     /     /  

CVE-2021-23889 Metadata Quick Info

CVE Published: 26/03/2021 | CVE Updated: 03/08/2024 | CVE Year: 2021
Source: trellix | Vendor: McAfee,LLC | Product: McAfee ePolicy Orchestrator (ePO)
Status : PUBLISHED

---

CVE-2021-23889 Description

Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator\'s entries were not correctly sanitized.

Metrics

CVSS Version: 3.1 | Base Score: 3.5 LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* LOW
    Privileges Required (PR)* HIGH
    User Interaction (UI)* REQUIRED
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* LOW
    Integrity Impact (I)* LOW
    Availability Impact (A)* NONE

Weakness Enumeration (CWE)

CWE-ID:
CWE Name: CWE 79: Cross-Site Scripting (XSS)
Source: McAfee,LLC

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).