VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jul 26, 2023· Updated Jun 17, 2026

CVE-2023-3946

CVE-2023-3946

Description

A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.

Affected products

21
  • McAfee/Epolicy Orchestrator19 versions
    cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*+ 18 more
    • cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*range: <5.10.0
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11_hotfix_1:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11_hotfix_2:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_13:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_14:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_15:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*
    • cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*
  • Trellix/ePOllm-fuzzy
    Range: <5.10 SP1 Update 1
  • Trellix/Trellix EPOv5
    Range:

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.