CVE-2020-7333: Cross-site Scripting (XSS) in firewall ePO extension of McAfee Endpoint Security (ENS)

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-11-12 · updated 2026-06-17
Weakness: CWE-79

Description

Cross site scripting vulnerability in the firewall ePO extension of McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows administrators to inject arbitrary web script or HTML via the configuration wizard.

Affected products

McAfee LLC McAfee Endpoint Security (ENS): before 10.7.0 — fixed in 10.7.0

How to fix

Upgrade to a fixed version: McAfee LLC McAfee Endpoint Security (ENS) 10.7.0. Check the vendor advisory for mitigations.

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10335
https://kc.mcafee.com/corporate/index?page=content&id=SB10335

Get alerted when CVE-2020-7333 or the next vulnerability affects your stack