ePO Reflected Cross-site scripting vulnerability
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in.
Why it matters now
EPSS 0.00722 54th percentileScored 2026-11-07
Fix Fixed McAfee ePolicy Orchestrator (ePO) (McAfee,LLC): 5.10 CU 13
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| McAfee | McAfee ePolicy Orchestrator (ePO) | before 5.10 CU 13 | 5.10 CU 13 | Patch available | CNA |
- McAfee ePolicy Orchestrator (ePO) VendorMcAfee Affected before 5.10 CU 13 Fixed in 5.10 CU 13 Patch available CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* | before 5.10.0 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:* | 5.10.0 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:* | 5.10.0 update_1 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:* | 5.10.0 update_10 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:* | 5.10.0 update_11 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:* | 5.10.0 update_12 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:* | 5.10.0 update_2 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:* | 5.10.0 update_3 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:* | 5.10.0 update_4 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:* | 5.10.0 update_5 | Vulnerable | McAfee |
- cpe:2.3:a:mcafee:epolicy_orchestrator:*:*:*:*:*:*:*:* Versions before 5.10.0 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-:*:*:*:*:*:* Versions 5.10.0 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_1:*:*:*:*:*:* Versions 5.10.0 update_1 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_10:*:*:*:*:*:* Versions 5.10.0 update_10 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_11:*:*:*:*:*:* Versions 5.10.0 update_11 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_12:*:*:*:*:*:* Versions 5.10.0 update_12 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_2:*:*:*:*:*:* Versions 5.10.0 update_2 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_3:*:*:*:*:*:* Versions 5.10.0 update_3 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_4:*:*:*:*:*:* Versions 5.10.0 update_4 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_5:*:*:*:*:*:* Versions 5.10.0 update_5 Vulnerable ·McAfee
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:* | 5.10.0 update_6 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:* | 5.10.0 update_7 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:* | 5.10.0 update_8 | Vulnerable | McAfee |
| cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:* | 5.10.0 update_9 | Vulnerable | McAfee |
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_6:*:*:*:*:*:* Versions 5.10.0 update_6 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_7:*:*:*:*:*:* Versions 5.10.0 update_7 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_8:*:*:*:*:*:* Versions 5.10.0 update_8 Vulnerable ·McAfee
- cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:update_9:*:*:*:*:*:* Versions 5.10.0 update_9 Vulnerable ·McAfee
Remediation
- Fix · CNA McAfee ePolicy Orchestrator (ePO) (McAfee,LLC) Fixed in 5.10 CU 13
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
McAfee,LLC McAfee ePolicy Orchestrator (ePO) 5.10 CU 13
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2022-00765 ePO database restoration vulnerabilityPriority LOW 29
- TI-2022-00749 ePO blind SQL Injection vulnerabilityPriority LOW 26
- TI-2022-00768 ePO password change vulnerabilityPriority LOW 25
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0857
- 2026-10-03 Alias added: GHSA-qpvw-vv3x-9vf4
References
More McAfee Epolicy Orchestrator vulnerabilities
- TI-2020-10912 Infinite loop in Apache Tomcat CVSS 3.1HIGH 7.5
- TI-2006-04972 Buffer overflow in McAfee ePolicy Orchestrator before 3.5.0.720 and ProtectionPilot… CVSS 2.0HIGH 10.0
- TI-2021-06204 Integer overflow in CipherUpdate CVSS 3.1HIGH 7.5
- TI-2021-12641 Incorrect Transfer-Encoding handling with HTTP/1.0 CVSS 3.1MEDIUM 5.3
- TI-2020-07593 Deserialization of untrusted data in Apache Tomcat CVSS 3.1HIGH 7.0
- TI-2021-02646 Read buffer overruns processing ASN.1 strings CVSS 3.1HIGH 7.4
Sources
- CVE-2022-0857 · CVE Program
- CVE-2022-0857 · NVD
- FIRST EPSS
- GHSA-qpvw-vv3x-9vf4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences