CVE-2023-3946
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link.
Risk Assessment
This vulnerability could lead to limited access to sensitive information and the ability to alter some information in ePO, posing a risk to the organization's security.
Recommendation
It is recommended to update ePO to version 5.10 SP1 Update 1 or later to mitigate this vulnerability and implement additional protections against XSS attacks.
Original NVD description (English source)
A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.