CVE-2022-0858: Cross-site scripting vulnerability in ePO

Q: What is CVE-2022-0858?

CVE-2022-0858 is a cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13.

Q: How does CVE-2022-0858 work?

CVE-2022-0858 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link.

Q: What software versions are affected by CVE-2022-0858?

CVE-2022-0858 affects McAfee ePolicy Orchestrator versions up to 5.10.0 and specific update versions up to 5.10.0-update_12.

Q: What is the severity of CVE-2022-0858?

The severity of CVE-2022-0858 is medium, with a CVSS score of 6.1.

Q: How can I fix CVE-2022-0858?

To fix CVE-2022-0858, update McAfee Enterprise ePolicy Orchestrator (ePO) to version 5.10 Update 13 or later.

Published Mar 23, 2022

Updated

A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in.

Affected Software

14 affected components

McAfee ePolicy Orchestrator<5.10.0

McAfee ePolicy Orchestrator=5.10.0

McAfee ePolicy Orchestrator=5.10.0-update_1

McAfee ePolicy Orchestrator=5.10.0-update_10

McAfee ePolicy Orchestrator=5.10.0-update_11

McAfee ePolicy Orchestrator=5.10.0-update_12

McAfee ePolicy Orchestrator=5.10.0-update_2

McAfee ePolicy Orchestrator=5.10.0-update_3

McAfee ePolicy Orchestrator=5.10.0-update_4

McAfee ePolicy Orchestrator=5.10.0-update_5

McAfee ePolicy Orchestrator=5.10.0-update_6

McAfee ePolicy Orchestrator=5.10.0-update_7

McAfee ePolicy Orchestrator=5.10.0-update_8

McAfee ePolicy Orchestrator=5.10.0-update_9

Event History

Mar 23, 2022

CVE Published

via MITRE·02:20 PM

Data Sourced

via MITRE·02:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2022-0858?

CVE-2022-0858 is a cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13.

How does CVE-2022-0858 work?

CVE-2022-0858 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link.

What software versions are affected by CVE-2022-0858?

CVE-2022-0858 affects McAfee ePolicy Orchestrator versions up to 5.10.0 and specific update versions up to 5.10.0-update_12.

What is the severity of CVE-2022-0858?

The severity of CVE-2022-0858 is medium, with a CVSS score of 6.1.

How can I fix CVE-2022-0858?