Read the docs
TI-2021-11845 Aliases CVE-2021-31852GHSA-c6xr-2587-83ff

Cross-Site Scripting vulnerability in Policy Auditor

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extract of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests.

Why it matters now

EPSS 0.00813 57th percentileScored 2026-11-07
Fix Fixed McAfee Policy Auditor (McAfee,LLC): 6.5.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Policy Auditorbefore 6.5.26.5.2Patch availableCNA
  • McAfee Policy Auditor VendorMcAfee Affected before 6.5.2 Fixed in 6.5.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:policy_auditor:*:*:*:*:*:*:*:*before 6.5.2VulnerableMcAfee
  • cpe:2.3:a:mcafee:policy_auditor:*:*:*:*:*:*:*:* Versions before 6.5.2 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Policy Auditor (McAfee,LLC) Fixed in 6.5.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    McAfee,LLC McAfee Policy Auditor 6.5.2

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-11844 Cross-Site Scripting vulnerability in Policy AuditorPriority LOW 29
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-31852
  2. 2026-10-03 Alias added: GHSA-c6xr-2587-83ff

References

Advisory 1

  • TI-2016-00645 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly… CVSS 3.1CRITICAL 9.8
  • TI-2016-03845 The overflow protection in Expat is removed by compilers with certain optimization… CVSS 3.1HIGH 8.1
  • TI-2017-12985 contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module… CVSS 3.1HIGH 7.5
  • TI-2017-06728 servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free… CVSS 3.1MEDIUM 6.5
  • TI-2019-12154 In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or… CVSS 3.1MEDIUM 6.5
  • TI-2019-09781 An issue was discovered in the server in OpenLDAP before 2.4.48. CVSS 3.1MEDIUM 4.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences