CVE-2020-7317: ePolicy Orchistrator (ePO) - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability in McAfee ePolicy Orchistrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via parameter values for "syncPointList" not being correctly sanitsed.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-7317?
CVE-2020-7317 is categorized as a cross-site scripting vulnerability which may allow attackers to inject arbitrary web scripts or HTML.
How do I fix CVE-2020-7317?
To fix CVE-2020-7317, upgrade to McAfee ePolicy Orchestrator version 5.10.9 Update 9 or later.
Which software versions are affected by CVE-2020-7317?
CVE-2020-7317 affects McAfee ePolicy Orchestrator versions prior to 5.10.9 Update 9, specifically versions up to 5.9.1 and between 5.10.0 and 5.10.9.
Can CVE-2020-7317 be exploited remotely?
Yes, CVE-2020-7317 can be exploited remotely if an administrator accesses a crafted URL containing the vulnerable parameter.
What impact does CVE-2020-7317 have on affected systems?
The impact of CVE-2020-7317 includes potential unauthorized execution of scripts in the context of the user's browser, leading to data theft or session hijacking.