CVE-2019-3591
Low
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.
SeverityLow
CVSS3.9
Exploit probability—
ProductMcafee Data Loss Prevention Endpoint
PublishedJul 24, 2019
First seenJul 24, 2019
How to fix
Update
- mcafee data_loss_prevention_endpoint11.1.200, 11.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mcafee data_loss_prevention_endpoint | 11.0 ≤ v < 11.1.200, 11.2.000 ≤ v < 11.3.0 | 11.1.200, 11.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.