What’s Vulnerable › Vulnerabilities

CVE-2021-31851: Cross-Site Scripting vulnerability in Policy Auditor

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-11-23 · updated 2026-06-17
• Weakness: CWE-79

Description

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the profileNodeID request parameters. The malicious script is reflected unmodified into the Policy Auditor web-based interface which could lead to the extraction of end user session token or login credentials. These may be used to access additional security-critical applications or conduct arbitrary cross-domain requests.

Affected products

• McAfee,LLC McAfee Policy Auditor: before 6.5.2 — fixed in 6.5.2

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee Policy Auditor 6.5.2. Check the vendor advisory for mitigations.

References

• https://kc.mcafee.com/corporate/index?page=content&id=SB10372
• https://kc.mcafee.com/corporate/index?page=content&id=SB10372

Get alerted when CVE-2021-31851 or the next vulnerability affects your stack