CVE-2021-23888
Assigner: trellix
Published: 2021-03-26T09:30:21
State: PUBLISHED
affected: product: McAfee ePolicy Orchestrator (ePO)
vendor: McAfee,LLC
versions: lessThan: 5.10 CU 10
status: affected
version: unspecified
versionType: custom
descriptions: value: Unvalidated client-side URL redirect vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 10 could cause an authenticated ePO user to load an untrusted site in an ePO iframe which could steal information from the authenticated user.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-601
description: CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
type: CWE
source: discovery: UNKNOWN
title: McAfee ePO unvalidated URL redirect vulnerability
x_generator: engine: Vulnogram 0.0.9