CVE-2022-3339: Reflected XSS in Trellix ePO server

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-18 · updated 2026-06-17
Weakness: CWE-79

Description

A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.

Affected products

McAfee,LLC McAfee ePolicy Orchestrator (ePO): before 5.10.0; 5.10.0, 5.10.0-update_1, 5.10.0-update_10, 5.10.0-update_11, 5.10.0-update_12, 5.10.0-update_13 (+8) — fixed in 5.10.0

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee ePolicy Orchestrator (ePO) 5.10.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-3339 or the next vulnerability affects your stack