CVE-2013-4883

Published: Jul 22, 2013Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the (1) instanceId parameter core/loadDisplayType.do; (2) instanceId or (3) monitorUrl parameter to console/createDashboardContainer.do; uid parameter to (4) ComputerMgmt/sysDetPanelBoolPie.do or (5) ComputerMgmt/sysDetPanelSummary.do; (6) uid, (7) orion.user.security.token, or (8) ajaxMode parameter to ComputerMgmt/sysDetPanelQry.do; or (9) uid, (10) orion.user.security.token, or (11) ajaxMode parameter to ComputerMgmt/sysDetPanelSummary.do.

Affected (9)

Products: Mcafee: Epolicy Orchestrator, Epolicy Orchestrator Agent

Mcafee

2 products

Epolicy Orchestrator

Epolicy Orchestrator Agent

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Mcafee Epolicy Orchestrator	Up to 4.6.6
Mcafee Epolicy Orchestrator	Version 4.6.0
Mcafee Epolicy Orchestrator	Version 4.6.1
Mcafee Epolicy Orchestrator	Version 4.6.2
Mcafee Epolicy Orchestrator	Version 4.6.3
Mcafee Epolicy Orchestrator	Version 4.6.4
Mcafee Epolicy Orchestrator	Version 4.6.5
Mcafee Epolicy Orchestrator Agent	Version 4.5
Mcafee Epolicy Orchestrator Agent	Version 4.6