CVE-2021-4038 — Cross-site Scripting in LLC Mcafee Network Security Manager

CWE-79 — Cross-site Scripting2 documents2 sources
Severity
4.8MEDIUMNVD
EPSS
0.1%
top 65.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Mcafee LLC Mcafee Network Security ManagerMcafee Network Security Manager
Timeline
PublishedDec 9
Latest updateDec 10

Description

Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in all scenarios.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages2 packages

▶CVEListV5mcafee_llc/mcafee_network_security_managerunspecified — 10.7 M7

🔴Vulnerability Details

1
GHSA
GHSA-jrmj-jm9w-qhxm: Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10↗2021-12-10
▶