CVE-2013-4883 Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6, allow remote attackers to inject....
MediumCVSS 4.3
EPSS 5.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the (1) instanceId parameter core/loadDisplayType.do; (2) instanceId or (3) monitorUrl parameter to console/createDashboardContainer.do; uid parameter to (4) ComputerMgmt/sysDetPanelBoolPie.do or (5) ComputerMgmt/sysDetPanelSummary.do; (6) uid, (7) orion.user.security.token, or (8) ajaxMode parameter to ComputerMgmt/sysDetPanelQry.do; or (9) uid, (10) orion.user.security.token, or (11) ajaxMode parameter to ComputerMgmt/sysDetPanelSummary.do.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mcafee epolicy orchestrator | <= 4.6.6 | No fix listed |
| mcafee epolicy orchestrator | = 4.6.0 | No fix listed |
| mcafee epolicy orchestrator | = 4.6.1 | No fix listed |
| mcafee epolicy orchestrator | = 4.6.2 | No fix listed |
| mcafee epolicy orchestrator | = 4.6.3 | No fix listed |
| mcafee epolicy orchestrator | = 4.6.4 | No fix listed |
| mcafee epolicy orchestrator | = 4.6.5 | No fix listed |
| mcafee epolicy orchestrator agent | = 4.5 | No fix listed |
| mcafee epolicy orchestrator agent | = 4.6 | No fix listed |
References
- 95187 vdb-entry
- 95188 vdb-entry
- 95189 vdb-entry
- 95190 vdb-entry
- 95191 vdb-entry
- 20130712 Multiple vulnerabilities in McAfee ePO 4.6.6 mailing-list
- 1028803 vdb-entry
- kc.mcafee.com vendor-advisory