$ cve CVE-2013-4883 JSON

CVE-2013-4883 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 5.1% (pctl 92)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the (1) instanceId parameter core/loadDisplayType.do; (2) instanceId or (3) monitorUrl parameter to console/createDashboardContainer.do; uid parameter to (4) ComputerMgmt/sysDetPanelBoolPie.do or (5) ComputerMgmt/sysDetPanelSummary.do; (6) uid, (7) orion.user.security.token, or (8) ajaxMode parameter to ComputerMgmt/sysDetPanelQry.do; or (9) uid, (10) orion.user.security.token, or (11) ajaxMode parameter to ComputerMgmt/sysDetPanelSummary.do.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	5.07% — more likely to be exploited than 92% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2013-07-22
Last modified	2026-06-16

Affected (2)

Vendor	Product
mcafee	epolicy orchestrator
mcafee	epolicy orchestrator agent

Public exploits

Source	Title	Date
exploit-db	McAfee ePO 4.6.6 - Multiple Vulnerabilities	2013-07-13

References

→ the Explorer · watch your stack · NVD