CVE-2023-3946: mcafee epolicy_orchestrator Cross-site Scripting
Vulnerability summary
CVE-2023-3946 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in mcafee epolicy_orchestrator. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46% of scored vulnerabilities.
Timeline
- 26-07-2023PublishedVulnerability first disclosed.
- 15-10-2024Last modifiedVulnerability information updated.
Description
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.4MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.57% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mcafee1 product
- epolicy_orchestrator< 5.10.0 | 5.10.0 | 5.10.0:update_1 | 5.10.0:update_10 | 5.10.0:update_11 | 5.10.0:update_11_hotfix_1 | 5.10.0:update_11_hotfix_2 | 5.10.0:update_12 | 5.10.0:update_13 | 5.10.0:update_14 | 5.10.0:update_15 | 5.10.0:update_2 | 5.10.0:update_3 | 5.10.0:update_4 | 5.10.0:update_5 | 5.10.0:update_6 | 5.10.0:update_7 | 5.10.0:update_8 | 5.10.0:update_9
Trellix1 product
- trellix epo< 5.10.0 SP1 UP1
2 vendors · 2 products
References
1 links- kcm.trellix.com/corporate/index?page=content&id=SB10402Vendor Advisory