CVE-2021-23889: 
McAfee ePolicy Orchestrator vulnerability analysis and mitigation

Cross-Site Scripting (XSS) vulnerability exists in McAfee ePolicy Orchestrator (ePO) versions prior to 5.10 Update 10. The vulnerability allows ePO administrators to inject arbitrary web script or HTML through multiple parameters where administrator entries were not properly sanitized (NVD, CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). It has received multiple CVSS scores: NIST assigned a base score of 4.8 (MEDIUM) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, while Trellix assigned a base score of 3.5 (LOW) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N (NVD).

The vulnerability could allow attackers to execute arbitrary web scripts or HTML in the context of the application, potentially leading to unauthorized access to sensitive information or manipulation of the application's content. The impact is limited by the requirement of administrator privileges and user interaction (NVD).

The vulnerability requires high privileges (administrator access) and user interaction to be exploited. The attack vector is network-based, with low attack complexity (NVD).

Users are advised to upgrade to McAfee ePolicy Orchestrator (ePO) version 5.10 Update 10 or later to address this vulnerability (Trellix Advisory).