Summary
This host is running McAfee ePolicy Orchestrator and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow remote attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site and inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data
Solution
Upgrade to McAfee ePolicy Orchestrator version 4.5.7 or higher, For updates refer to http://www.mcafee.com/in/products/epolicy-orchestrator.aspx
Insight
Multiple flaw are due to improper sanitation of user supplied input via, - 'instanceId' parameter upon submission to the /core/loadDisplayType.do script.
- 'instanceId', 'orion.user.security.token', and 'ajaxMode' parameters upon submission to the /console/createDashboardContainer.do script.
- 'uid' parameter upon submission to the /core/showRegisteredTypeDetails.do and /ComputerMgmt/sysDetPanelBoolPie.do scripts.
- 'uid', 'orion.user.security.token', and 'ajaxMode' parameters upon submission to the /ComputerMgmt/sysDetPanelSummary.do and /ComputerMgmt/sysDetPanelQry.do scripts.
Affected
McAfee ePolicy Orchestrator (ePO) version 4.6.6 and earlier
Detection
Get the installed version with the help detect NVT and check the version is vulnerable or not.
References
Severity
Classification
-
CVE CVE-2013-4882, CVE-2013-4883 -
CVSS Base Score: 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P
Related Vulnerabilities