CVE-2020-7317: 
McAfee ePolicy Orchestrator vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was identified in McAfee ePolicy Orchestrator (ePO) versions prior to 5.10.9 Update 9. The vulnerability, assigned CVE-2020-7317, was discovered and initially recorded on January 21, 2020. The issue specifically affects the administrator interface where parameter values for 'syncPointList' were not properly sanitized (MITRE CVE).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue, identified with CWE-79. The flaw exists in the parameter values for 'syncPointList' which lacks proper sanitization, allowing administrators to inject arbitrary web script or HTML (NVD Database).

The vulnerability allows administrators to inject arbitrary web script or HTML through the affected parameter, potentially leading to execution of unauthorized scripts in the context of other users' browsers (MITRE CVE).

The vulnerability specifically affects administrator accounts, which somewhat limits its potential scope of exploitation. The attack requires administrator access to the ePO system to exploit the vulnerability (NVD Database).

McAfee addressed this vulnerability by releasing version 5.10.9 Update 9 of ePolicy Orchestrator. Users are advised to upgrade to this version or later to mitigate the vulnerability (MITRE CVE).