2023-07-26 08:00:30 +00:00
{
"id" : "CVE-2023-3946" ,
"sourceIdentifier" : "trellixpsirt@trellix.com" ,
"published" : "2023-07-26T06:15:11.080" ,
2023-08-03 18:00:44 +00:00
"lastModified" : "2023-08-03T17:18:16.407" ,
"vulnStatus" : "Analyzed" ,
2023-07-26 08:00:30 +00:00
"descriptions" : [
{
"lang" : "en" ,
"value" : "\nA reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.\n\n\n"
}
] ,
"metrics" : {
"cvssMetricV31" : [
2023-08-03 18:00:44 +00:00
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "REQUIRED" ,
"scope" : "CHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 6.1 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 2.7
} ,
2023-07-26 08:00:30 +00:00
{
"source" : "trellixpsirt@trellix.com" ,
"type" : "Secondary" ,
"cvssData" : {
"version" : "3.1" ,
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N" ,
"attackVector" : "NETWORK" ,
"attackComplexity" : "LOW" ,
"privilegesRequired" : "NONE" ,
"userInteraction" : "REQUIRED" ,
"scope" : "UNCHANGED" ,
"confidentialityImpact" : "LOW" ,
"integrityImpact" : "LOW" ,
"availabilityImpact" : "NONE" ,
"baseScore" : 5.4 ,
"baseSeverity" : "MEDIUM"
} ,
"exploitabilityScore" : 2.8 ,
"impactScore" : 2.5
}
]
} ,
"weaknesses" : [
2023-08-03 18:00:44 +00:00
{
"source" : "nvd@nist.gov" ,
"type" : "Primary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-79"
}
]
} ,
2023-07-26 08:00:30 +00:00
{
"source" : "trellixpsirt@trellix.com" ,
"type" : "Secondary" ,
"description" : [
{
"lang" : "en" ,
"value" : "CWE-79"
}
]
}
] ,
2023-08-03 18:00:44 +00:00
"configurations" : [
{
"nodes" : [
{
"operator" : "OR" ,
"negate" : false ,
"cpeMatch" : [
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*" ,
"versionEndExcluding" : "5.10.0" ,
"matchCriteriaId" : "A30F7908-5AF6-4761-BC6A-4C18EFAE48E5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:*" ,
"matchCriteriaId" : "0F30D3AF-4FA3-4B7A-BE04-C24E2EA19A95"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:*" ,
"matchCriteriaId" : "7B00DDE7-7002-45BE-8EDE-65D964922CB0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:*" ,
"matchCriteriaId" : "DB88C165-BB24-49FB-AAF6-087A766D5AD1"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:*" ,
"matchCriteriaId" : "C879487A-3378-4C5D-9DA6-308D06B786A0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11_hotfix_1:*:*:*:*:*:*" ,
"matchCriteriaId" : "01D8BF05-C02C-432A-AA3A-2FA20E6FD859"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11_hotfix_2:*:*:*:*:*:*" ,
"matchCriteriaId" : "66235835-40DC-4F35-B5E2-C673059ADCF2"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:*" ,
"matchCriteriaId" : "523E143F-E8B3-4B24-AD64-65BF5A8677A7"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_13:*:*:*:*:*:*" ,
"matchCriteriaId" : "3AF53482-AE68-40F8-8FA6-0A2DAC019A34"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_14:*:*:*:*:*:*" ,
"matchCriteriaId" : "62995EC0-0A00-4140-8C76-1D7648A9FB46"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_15:*:*:*:*:*:*" ,
"matchCriteriaId" : "7E5A7025-BC7B-43F4-BC66-902A10A0A200"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:*" ,
"matchCriteriaId" : "FF806B52-DAD5-4D12-8BB6-3CBF9DC6B8DF"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:*" ,
"matchCriteriaId" : "7DE847E0-431D-497D-9C57-C4E59749F6A0"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:*" ,
"matchCriteriaId" : "46385384-5561-40AA-9FDE-A2DE4FDFAD3E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:*" ,
"matchCriteriaId" : "B7CA7CA6-7CF2-48F6-81B5-69BA0A37EF4E"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:*" ,
"matchCriteriaId" : "9E4E5481-1070-4E1F-8679-1985DE4E785A"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:*" ,
"matchCriteriaId" : "D9EEA681-67FF-43B3-8610-0FA17FD279E5"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:*" ,
"matchCriteriaId" : "C33BA8EA-793D-4E79-BE9C-235ACE717216"
} ,
{
"vulnerable" : true ,
"criteria" : "cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:*" ,
"matchCriteriaId" : "823DBE80-CB8D-4981-AE7C-28F3FDD40451"
}
]
}
]
}
] ,
2023-07-26 08:00:30 +00:00
"references" : [
{
"url" : "https://kcm.trellix.com/corporate/index?page=content&id=SB10402" ,
2023-08-03 18:00:44 +00:00
"source" : "trellixpsirt@trellix.com" ,
"tags" : [
"Vendor Advisory"
]
2023-07-26 08:00:30 +00:00
}
]
}
