CVE-2021-31832CWE-79

Cross site scripting vulnerability in DLP Endpoint for Windows

Medium · published June 9, 2021

CVSS v3.1
5.2
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject JavaScript code into the alert configuration text field. This JavaScript will be executed when an end user triggers a DLP policy on their machine.

The record
Technical detail
CVSS v3.1
5.2 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00503 · 42.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-06-09T13:45Z
EPSS history
Timeline
  • 09 JUN 13:45Z
    Cross site scripting vulnerability in DLP Endpoint for Windows
    cvelistv5