CVE-2017-3902: XSS

Published Feb 13, 2017

Updated

Cross-site scripting (XSS) vulnerability in the Web user interface (UI) in Intel Security ePO 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows authenticated users to inject malicious Java scripts via bypassing input validation.

Affected Software

4 affected components

McAfee ePolicy Orchestrator=5.1.0

McAfee ePolicy Orchestrator=5.1.1

McAfee ePolicy Orchestrator=5.1.2

McAfee ePolicy Orchestrator=5.1.3

Remediation

Patch Available

https://kc.mcafee.com/corporate/index?page=content&id=SB10184

Event History

Feb 13, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionWeakness

Data Sourced

via NVD·04:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-3902?

CVE-2017-3902 is classified as a medium severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2017-3902?

To fix CVE-2017-3902, upgrade to a patched version of Intel Security ePO, specifically versions 5.1.4 or later.

Who is affected by CVE-2017-3902?

Authenticated users of Intel Security ePO versions 5.1.0 to 5.1.3 are affected by CVE-2017-3902.

Can CVE-2017-3902 allow malicious scripts to run?

Yes, CVE-2017-3902 can allow authenticated users to inject and execute malicious Java scripts through the web interface.

What is the impact of CVE-2017-3902?

The impact of CVE-2017-3902 can lead to unauthorized actions being taken on behalf of users, potentially breaching data integrity.