{"id":"CVE-2020-7309","aliases":["EUVD-2020-28436","GHSA-2h39-8g97-pccq"],"status":"published","title":"Cross Site Scripting vulnerability in ePO extension of MACC","description":"Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00367,"percentile":0.3083,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2020-08-26T06:00:19Z","modified":"2026-06-17T03:24:41Z","products":[{"vendor":"mcafee","product":"application_and_change_control"},{"vendor":"mcafee, llc","product":"mcafee application and change control"}],"references":[{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10324","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7309"},{"url":"https://github.com/advisories/GHSA-2h39-8g97-pccq"}],"sources":{"cve":[{"id":"CVE-2020-7309","title":"Cross Site Scripting vulnerability in ePO extension of MACC","description":"Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.","status":"published","published":"2020-08-26T06:00:19.835Z","modified":"2024-09-16T17:03:22.066Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:58.331892Z"}],"euvd":[{"id":"EUVD-2020-28436","description":"Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.","status":"published","published":"2020-08-26T06:00:19Z","modified":"2024-09-16T17:03:22Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low"}],"updated_at":"2026-11-03T00:55:45.787721Z"}],"ghsa":[{"id":"GHSA-2h39-8g97-pccq","title":"Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to...","description":"Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.","status":"published","published":"2022-05-24T17:26:46Z","modified":"2023-01-29T05:03:50Z","updated_at":"2026-11-02T14:45:24.688971Z"}],"nvd":[{"id":"CVE-2020-7309","description":"Cross Site Scripting vulnerability in ePO extension in McAfee Application Control (MAC) prior to 8.3.1 allows administrators to inject arbitrary web script or HTML via specially crafted input in the policy discovery section.","status":"published","published":"2020-08-26T06:15:12.403Z","modified":"2026-06-17T03:24:41.763Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:13.600965Z"}]}}