CVE-2024-5955

Cross-site scripting vulnerability in Trellix ePolicy Orchestrator prior to ePO 5.10 Service Pack 1 Update 3 allows a remote authenticated attacker to craft requests causing arbitrary content to be injected into the response when accessing the epolicy Orchestrator.

Score

CVSS 3.1 5.4 Medium

Status

Deferred - trellixpsirt@trellix.com

Published

2024-12-20

Last modified

2024-12-20

Weaknesses

CWE-79

Affected products

• Epo Onprem Sp1 Update4 (Trellix)

References

• https://thrive.trellix.com/s/article/000014118