CVE-2021-31830: Cross site Scripting (XSS) vulnerability in McAfee DBSec

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-03 · updated 2026-06-17
Weakness: CWE-79

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in McAfee Database Security (DBSec) prior to 4.8.2 allows an administrator to embed JavaScript code when configuring the name of a database to be monitored. This would be triggered when any authorized user logs into the DBSec interface and opens the properties configuration page for this database.

Affected products

McAfee,LLC McAfee Database Security (DBSec): before 4.8.2 — fixed in 4.8.2

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee Database Security (DBSec) 4.8.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-31830 or the next vulnerability affects your stack