CVE-2013-4883

Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the (1) instanceId parameter core/loadDisplayType.do; (2) instanceId or (3) monitorUrl parameter to console/createDashboardContainer.do; uid parameter to (4) ComputerMgmt/sysDetPanelBoolPie.do or (5) ComputerMgmt/sysDetPanelSummary.do; (6) uid, (7) orion.user.security.token, or (8) ajaxMode parameter to ComputerMgmt/sysDetPanelQry.do; or (9) uid, (10) orion.user.security.token, or (11) ajaxMode parameter to ComputerMgmt/sysDetPanelSummary.do.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://osvdb.org/95188
https://kc.mcafee.com/corporate/index?page=content&id=KB78824	Vendor Advisory
http://osvdb.org/95189
http://www.securityfocus.com/archive/1/527228
http://osvdb.org/95187
http://osvdb.org/95190
http://osvdb.org/95191
http://www.securitytracker.com/id/1028803

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.3:::::::*
	cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.2:::::::*
	cpe:2.3:a:mcafee:epolicy_orchestrator_agent:4.6:::::::*
	cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.0:::::::*
	cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.1:::::::*
	cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.5:::::::*
	cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.4:::::::*
	cpe:2.3:a:mcafee:epolicy_orchestrator::::::::
	cpe:2.3:a:mcafee:epolicy_orchestrator_agent:4.5:::::::*

Information

Published : 2013-07-22 04:21

Updated : 2013-08-21 23:54

NVD link : CVE-2013-4883

Mitre link : CVE-2013-4883

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Products Affected

mcafee

epolicy_orchestrator
epolicy_orchestrator_agent

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://osvdb.org/95188", "name": "95188", "tags": [], "refsource": "OSVDB"}, {"url": "https://kc.mcafee.com/corporate/index?page=content&id=KB78824", "name": "https://kc.mcafee.com/corporate/index?page=content&id=KB78824", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://osvdb.org/95189", "name": "95189", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.securityfocus.com/archive/1/527228", "name": "20130712 Multiple vulnerabilities in McAfee ePO 4.6.6", "tags": [], "refsource": "BUGTRAQ"}, {"url": "http://osvdb.org/95187", "name": "95187", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/95190", "name": "95190", "tags": [], "refsource": "OSVDB"}, {"url": "http://osvdb.org/95191", "name": "95191", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.securitytracker.com/id/1028803", "name": "1028803", "tags": [], "refsource": "SECTRACK"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the (1) instanceId parameter core/loadDisplayType.do; (2) instanceId or (3) monitorUrl parameter to console/createDashboardContainer.do; uid parameter to (4) ComputerMgmt/sysDetPanelBoolPie.do or (5) ComputerMgmt/sysDetPanelSummary.do; (6) uid, (7) orion.user.security.token, or (8) ajaxMode parameter to ComputerMgmt/sysDetPanelQry.do; or (9) uid, (10) orion.user.security.token, or (11) ajaxMode parameter to ComputerMgmt/sysDetPanelSummary.do."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-4883", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2013-07-22T11:21Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:epolicy_orchestrator_agent:4.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:epolicy_orchestrator:4.6.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "4.6.6"}, {"cpe23Uri": "cpe:2.3:a:mcafee:epolicy_orchestrator_agent:4.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2013-08-22T06:54Z"}

4.3 /10