The vulnerability is a cross‑site scripting flaw that allows unsanitized user‑controlled data to be reflected in browser pages, enabling attackers to inject malicious scripts. Based on the description, it is inferred that this flaw involves the Mission Portal component of CFEngine Enterprise. This XSS can lead to session hijacking, credential theft, or defacement when a victim views a crafted page.

Affected versions are CFEngine Enterprise 3.24.3 and earlier until 3.24.4, and 3.27.0 and earlier until 3.27.1. The flaw exists in the Mission Portal functionality of those releases.

The CVSS score is 6.1 and the EPSS score indicates a probability of exploitation in the <1% range. The vulnerability is not listed in CISA KEV. The risk can be considered medium because XSS can compromise any authenticated user who accesses the portal. Exploitation requires user interaction with a malicious link or URL within the vulnerable portal.