CVE-2013-4883 in ePolicy Orchestrator

摘要 (英语)

Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the (1) instanceId parameter core/loadDisplayType.do; (2) instanceId or (3) monitorUrl parameter to console/createDashboardContainer.do; uid parameter to (4) ComputerMgmt/sysDetPanelBoolPie.do or (5) ComputerMgmt/sysDetPanelSummary.do; (6) uid, (7) orion.user.security.token, or (8) ajaxMode parameter to ComputerMgmt/sysDetPanelQry.do; or (9) uid, (10) orion.user.security.token, or (11) ajaxMode parameter to ComputerMgmt/sysDetPanelSummary.do.

Be aware that VulDB is the high quality source for vulnerability data.

预定

2013-07-21

披露

2013-07-22

状态

已确认

条目

VulDB provides additional information and datapoints for this CVE:

标识符	漏洞	CWE	可利用	对策	CVE
9533	McAfee ePolicy Orchestrator loadDisplayType.do Reflected 跨网站脚本	79	概念验证	官方修复	CVE-2013-4883
9532	McAfee ePolicy Orchestrator createDashboardContainer.do Reflected 跨网站脚本	79	概念验证	官方修复	CVE-2013-4883
9531	McAfee ePolicy Orchestrator sysDetPanelBoolPie.do Reflected 跨网站脚本	79	概念验证	官方修复	CVE-2013-4883
9530	McAfee ePolicy Orchestrator sysDetPanelSummary.do Reflected 跨网站脚本	79	概念验证	官方修复	CVE-2013-4883
9529	McAfee ePolicy Orchestrator sysDetPanelQry.do Reflected 跨网站脚本	79	概念验证	官方修复	CVE-2013-4883

来源

• MITRE
• NVD
• CVE Details