Vulnerability · Published Nov 23, 2021 · Assigned by trellix

CVE-2021-31852Cross-Site Scripting vulnerability in Policy Auditor

Medium 6.1

In plain English

A medium-severity cross-site scripting in McAfee Policy Auditor from McAfee,LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.8%top 42.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extract of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests.

Affected products (as reported)

Vendor	Product	Versions
McAfee,LLC	McAfee Policy Auditor	unspecified – before 6.5.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10372 x_refsource_CONFIRM