VulnerabilityModified
CVE-2010-2290
Cross-site scripting (XSS) vulnerability in cgi-bin/cgix/help in McAfee Unified Threat Management (UTM) Firewall (formerly SnapGear) firmware 3.0.0 through 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
MEDIUM 4.3EPSS 1.33%
Does this matter?
Lower severity and a low EPSS score (1.33%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in cgi-bin/cgix/help in McAfee Unified Threat Management (UTM) Firewall (formerly SnapGear) firmware 3.0.0 through 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.33% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- mcafee/unified threat management firewall firmware
- Source
- cve@mitre.org
References
- http://ngenuity-is.com/advisories/2010/jun/9/mcafee-utm-firewall-help-cross-site-scripting/Exploit
- http://secunia.com/advisories/40089Vendor Advisory
- http://secunia.com/advisories/40138Vendor Advisory
- http://www.securityfocus.com/archive/1/511771/100/0/threaded
- http://www.securitytracker.com/id?1024091Exploit
- http://www.vupen.com/english/advisories/2010/1413Vendor Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10010Patch, Vendor Advisory
- http://ngenuity-is.com/advisories/2010/jun/9/mcafee-utm-firewall-help-cross-site-scripting/Exploit
- http://secunia.com/advisories/40089Vendor Advisory
- http://secunia.com/advisories/40138Vendor Advisory
- http://www.securityfocus.com/archive/1/511771/100/0/threaded
- http://www.securitytracker.com/id?1024091Exploit
- http://www.vupen.com/english/advisories/2010/1413Vendor Advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10010Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.