title: ePolicy Orchestrator Cloud update fixes multiple Cross-Site Request Forgery vulnerabilities
description: Cross-Site Request Forgery (CSRF) vulnerability in McAfee ePO (legacy) Cloud allows unauthenticated users to perform unintended ePO actions using an authenticated user's session via unspecified vectors.
problem types: Cross Site Request Forgery (aka Session Riding) vulnerability
affected:
{
platforms: Cloud
product: ePolicy Orchestrator Cloud
vendor: McAfee, LLC
versions:
lessThan: Current, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
version: 3.0
]