CVE-2021-23888

CWE-601 — Open Redirect3 documents3 sources
Severity
6.3MEDIUM
EPSS
0.5%
top 34.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mcafee,llc Mcafee Epolicy Orchestrator (epo)Mcafee Epolicy Orchestrator
Timeline
PublishedMar 26
Latest updateMay 24

Description

Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:NExploitability: 2.1 | Impact: 4.2

Affected Packages2 packages

▶CVEListV5mcafee,llc/mcafee_epolicy_orchestrator_(epo)unspecified — 5.10 CU 10

🔴Vulnerability Details

2
GHSA
GHSA-6h63-w9wm-rccq: Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5↗2022-05-24
▶
CVEList
McAfee ePO unvalidated URL redirect vulnerability↗2021-03-26
▶