Vulnerability · Published Jun 3, 2021 · Assigned by trellix

CVE-2021-31830Cross site Scripting (XSS) vulnerability in McAfee DBSec

Medium 5.9

In plain English

A medium-severity cross-site scripting in McAfee Database Security (DBSec) from McAfee,LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.5%top 56.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to embed JavaScript code when configuring the name of a database to be monitored. This would be triggered when any authorized user logs into the DBSec interface and opens the properties configuration page for this database.

Affected products (as reported)

Vendor	Product	Versions
McAfee,LLC	McAfee Database Security (DBSec)	unspecified – before 4.8.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10359 x_refsource_CONFIRM