Vulnerability Name: | CVE-2017-3902 (CCN-120950) | ||||||||||||
Assigned: | 2016-12-26 | ||||||||||||
Published: | 2017-01-17 | ||||||||||||
Updated: | 2017-07-26 | ||||||||||||
Summary: | Cross-site scripting (XSS) vulnerability in the Web user interface (UI) in Intel Security ePO 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows authenticated users to inject malicious Java scripts via bypassing input validation. | ||||||||||||
CVSS v3 Severity: | 5.4 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) 4.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
5.3 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C)
| ||||||||||||
CVSS v2 Severity: | 3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
| ||||||||||||
Vulnerability Type: | CWE-79 | ||||||||||||
Vulnerability Consequences: | Cross-Site Scripting | ||||||||||||
References: | Source: MITRE Type: CNA CVE-2017-3902 Source: BID Type: UNKNOWN 96465 Source: CCN Type: BID-96465 McAfee ePolicy Orchestrator CVE-2017-3902 Cross Site Scripting Vulnerability Source: SECTRACK Type: UNKNOWN 1037628 Source: XF Type: UNKNOWN epolicy-orchestrator-cve20173902-xss(120950) Source: CCN Type: McAfee Security Bulletin ID: SB10184 ePolicy Orchestrator update fixes cross-site scripting vulnerability (CVE-2017-3902) Source: CONFIRM Type: Patch, Vendor Advisory https://kc.mcafee.com/corporate/index?page=content&id=SB10184 | ||||||||||||
Vulnerable Configuration: | Configuration 1: Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
BACK |