CVE-2021-31834 - Vulnerability Details

Vendors	Products
Mcafee	Epolicy Orchestrator

Link	Providers
https://kc.mcafee.com/corporate/index?page=content&id=SB10366

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "McAfee ePolicy Orchestrator (ePO)", "vendor": "McAfee,LLC", "versions": [{"lessThan": "5.10 CU 11", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized."}], "metrics": [{"other": {"content": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "4.8"}, "type": "unknown"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Cross-site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-22T11:05:18", "orgId": "01626437-bf8f-4d1c-912a-893b5eb04808", "shortName": "trellix"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10366"}], "source": {"discovery": "UNKNOWN"}, "title": "McAfee ePO Cross-Site Scripting vulnerability", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@mcafee.com", "ID": "CVE-2021-31834", "STATE": "PUBLIC", "TITLE": "McAfee ePO Cross-Site Scripting vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "McAfee ePolicy Orchestrator (ePO)", "version": {"version_data": [{"version_affected": "<", "version_value": "5.10 CU 11"}]}}]}, "vendor_name": "McAfee,LLC"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "version": "4.8"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-79 Cross-site Scripting (XSS)"}]}]}, "references": {"reference_data": [{"name": "https://kc.mcafee.com/corporate/index?page=content&id=SB10366", "refsource": "CONFIRM", "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10366"}]}, "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T23:10:30.570Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10366"}]}]}, "cveMetadata": {"assignerOrgId": "01626437-bf8f-4d1c-912a-893b5eb04808", "assignerShortName": "trellix", "cveId": "CVE-2021-31834", "datePublished": "2021-10-22T11:05:18", "dateReserved": "2021-04-27T00:00:00", "dateUpdated": "2024-08-03T23:10:30.570Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : McAfee ePolicy Orchestrator (ePO) (string)

vendor : McAfee,LLC (string)

versions : [ »

0 : { »

lessThan : 5.10 CU 11 (string)

status : affected (string)

version : unspecified (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. (string)

}

]

metrics : [ »

0 : { »

other : { »

content : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 3.5 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N (string)

version : 4.8 (string)

}

type : unknown (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-79 (string)

description : CWE-79 Cross-site Scripting (XSS) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2021-10-22T11:05:18 (string)

orgId : 01626437-bf8f-4d1c-912a-893b5eb04808 (string)

shortName : trellix (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://kc.mcafee.com/corporate/index?page=content&id=SB10366 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : McAfee ePO Cross-Site Scripting vulnerability (string)

x_generator : { »

engine : Vulnogram 0.0.9 (string)

}

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : psirt@mcafee.com (string)

ID : CVE-2021-31834 (string)

STATE : PUBLIC (string)

TITLE : McAfee ePO Cross-Site Scripting vulnerability (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : McAfee ePolicy Orchestrator (ePO) (string)

version : { »

version_data : [ »

0 : { »

version_affected : < (string)

version_value : 5.10 CU 11 (string)

}

]

}

]

}

vendor_name : McAfee,LLC (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. (string)

}

]

}

generator : { »

engine : Vulnogram 0.0.9 (string)

}

impact : { »

cvss : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 3.5 (number)

baseSeverity : LOW (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N (string)

version : 4.8 (string)

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : CWE-79 Cross-site Scripting (XSS) (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://kc.mcafee.com/corporate/index?page=content&id=SB10366 (string)

refsource : CONFIRM (string)

url : https://kc.mcafee.com/corporate/index?page=content&id=SB10366 (string)

}

]

}

source : { »

discovery : UNKNOWN (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T23:10:30.570Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://kc.mcafee.com/corporate/index?page=content&id=SB10366 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 01626437-bf8f-4d1c-912a-893b5eb04808 (string)

assignerShortName : trellix (string)

cveId : CVE-2021-31834 (string)

datePublished : 2021-10-22T11:05:18 (string)

dateReserved : 2021-04-27T00:00:00 (string)

dateUpdated : 2024-08-03T23:10:30.570Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "A30F7908-5AF6-4761-BC6A-4C18EFAE48E5", "versionEndExcluding": "5.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*", "matchCriteriaId": "0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*", "matchCriteriaId": "7B00DDE7-7002-45BE-8EDE-65D964922CB0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*", "matchCriteriaId": "DB88C165-BB24-49FB-AAF6-087A766D5AD1", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*", "matchCriteriaId": "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*", "matchCriteriaId": "7DE847E0-431D-497D-9C57-C4E59749F6A0", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*", "matchCriteriaId": "46385384-5561-40AA-9FDE-A2DE4FDFAD3E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*", "matchCriteriaId": "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*", "matchCriteriaId": "9E4E5481-1070-4E1F-8679-1985DE4E785A", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*", "matchCriteriaId": "D9EEA681-67FF-43B3-8610-0FA17FD279E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*", "matchCriteriaId": "C33BA8EA-793D-4E79-BE9C-235ACE717216", "vulnerable": true}, {"criteria": "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*", "matchCriteriaId": "823DBE80-CB8D-4981-AE7C-28F3FDD40451", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized."}, {"lang": "es", "value": "Una vulnerabilidad de tipo Cross-Site Scripting almacenado en McAfee ePolicy Orchestrator (ePO) versiones anteriores a la Actualizaci\u00f3n 5.10 11, permite a administradores de ePO inyectar scripts web o HTML arbitrarios por medio de varios par\u00e1metros en los que las entradas del administrador no se han saneado correctamente"}], "id": "CVE-2021-31834", "lastModified": "2024-11-21T06:06:19.303", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-10-22T11:15:07.837", "references": [{"source": "trellixpsirt@trellix.com", "tags": ["Broken Link"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10366"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://kc.mcafee.com/corporate/index?page=content&id=SB10366"}], "sourceIdentifier": "trellixpsirt@trellix.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "trellixpsirt@trellix.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* (string)

matchCriteriaId : A30F7908-5AF6-4761-BC6A-4C18EFAE48E5 (string)

versionEndExcluding : 5.10.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:* (string)

matchCriteriaId : 0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:* (string)

matchCriteriaId : 7B00DDE7-7002-45BE-8EDE-65D964922CB0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:* (string)

matchCriteriaId : DB88C165-BB24-49FB-AAF6-087A766D5AD1 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:* (string)

matchCriteriaId : FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:* (string)

matchCriteriaId : 7DE847E0-431D-497D-9C57-C4E59749F6A0 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:* (string)

matchCriteriaId : 46385384-5561-40AA-9FDE-A2DE4FDFAD3E (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:* (string)

matchCriteriaId : B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:* (string)

matchCriteriaId : 9E4E5481-1070-4E1F-8679-1985DE4E785A (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:* (string)

matchCriteriaId : D9EEA681-67FF-43B3-8610-0FA17FD279E5 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:* (string)

matchCriteriaId : C33BA8EA-793D-4E79-BE9C-235ACE717216 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:* (string)

matchCriteriaId : 823DBE80-CB8D-4981-AE7C-28F3FDD40451 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized. (string)

}

1 : { »

lang : es (string)

value : Una vulnerabilidad de tipo Cross-Site Scripting almacenado en McAfee ePolicy Orchestrator (ePO) versiones anteriores a la Actualización 5.10 11, permite a administradores de ePO inyectar scripts web o HTML arbitrarios por medio de varios parámetros en los que las entradas del administrador no se han saneado correctamente (string)

}

]

id : CVE-2021-31834 (string)

lastModified : 2024-11-21T06:06:19.303 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : LOW (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 3.5 (number)

confidentialityImpact : NONE (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:S/C:N/I:P/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 6.8 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.3 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2021-10-22T11:15:07.837 (string)

references : [ »

0 : { »

source : trellixpsirt@trellix.com (string)

tags : [ »

0 : Broken Link (string)

]

url : https://kc.mcafee.com/corporate/index?page=content&id=SB10366 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Broken Link (string)

]

url : https://kc.mcafee.com/corporate/index?page=content&id=SB10366 (string)

}

]

sourceIdentifier : trellixpsirt@trellix.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : trellixpsirt@trellix.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object