Read the docs
TI-2020-05914 Aliases CVE-2020-7309GHSA-2h39-8g97-pccq

Cross Site Scripting vulnerability in ePO extension of MACC

Priority LOW 22CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.

Why it matters now

EPSS 0.00367 30th percentileScored 2026-11-07
Fix Fixed McAfee Application and Change Control (McAfee, LLC): 8.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Application and Change Control8.3.1 to before 8.3.18.3.1Patch availableCNA
  • McAfee Application and Change Control VendorMcAfee Affected 8.3.1 to before 8.3.1 Fixed in 8.3.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:application_and_change_control:*:*:*:*:*:*:*:*before 8.3.1VulnerableMcAfee
  • cpe:2.3:a:mcafee:application_and_change_control:*:*:*:*:*:*:*:* Versions before 8.3.1 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Application and Change Control (McAfee, LLC) Fixed in 8.3.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7309
  2. 2026-10-03 Alias added: GHSA-2h39-8g97-pccq

References

Other 1

  • TI-2020-05937 Improper privilege assignment vulnerability in the installer component of MACC CVSS 3.1HIGH 8.2
  • TI-2021-11827 Improper privilege management in McAfee Application and Change Control CVSS 3.1HIGH 7.8
  • TI-2020-05867 MACC installer DLL side loading CVSS 3.1HIGH 7.8
  • TI-2017-02997 Improper authentication in McAfee Application Control and Change Control CVSS 3.0HIGH 7.8
  • TI-2023-00213 Improper privilege management in Trellix Application and Change Control CVSS 3.1MEDIUM 4.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences