CVE-2019-3591

DLP Endpoint ePO extension vulnerable to XSS

Low · published July 24, 2019

CVSS v3.0
3.9
EPSS
1%
Percentile
57.0
In the wild
Unconfirmed
What it is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.

The record
Technical detail
CVSS v3.0
3.9 · LOW
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00825 · 57.0th percentile
Published
2019-07-24T14:30Z
EPSS history
Timeline
  • 24 JUL 14:30Z
    DLP Endpoint ePO extension vulnerable to XSS
    cvelistv5