CVE-2022-3339 - CVE House
Back to Database
Status published Medium CVE-2022-3339

Reflected XSS in Trellix ePO server

Vulnerability Description

A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-3339

Credits & Attribution

No credits recorded in the NVD database.

References

More from Trellix

View All →
CVE-2025-7958
A Code Injection vulnerability existed in Trellix Network Security CM...
High 7.1
CVE-2025-5967
A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows...
Medium 5.3
CVE-2025-3773
A sensitive information exposure vulnerability in System Information Reporter...
Unknown 0
CVE-2025-3771
A path or symbolic link manipulation vulnerability in SIR 1.0.3...
High 7.2
CVE-2025-3722
A path traversal vulnerability in System Information Reporter (SIR) 1.0.3...
Unknown 0

Affected Vendor

Affected Software

Trellix ePolicy Orchestrator (ePO)
Vulnerable Versions:
unspecified

Timeline

Official Publish: October 18th, 2022
Last Modified: May 8th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-79

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact