Lucene search

TrellixCVE-2020-7301

HistoryAug 12, 2020 - 10:15 p.m.

CVE-2020-7301

2020-08-1222:15:12

CWE-79

trellix

web.nvd.nist.gov

cve-2020-7301

cross site scripting

xss

mcafee dlp

epo

data loss prevention

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section.

Affected configurations

Nvd

Node

mcafeedata_loss_preventionRange11.3.0–11.3.28

mcafeedata_loss_preventionRange11.4.0–11.4.200

mcafeedata_loss_preventionRange11.5.0–11.5.3

VendorProductVersionCPE
mcafeedata_loss_prevention*cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mcafee	data_loss_prevention	*	cpe:2.3:a:mcafee:data_loss_prevention::::::::

CNA Affected

[
  {
    "product": "DLP ePO extension",
    "vendor": "McAfee",
    "versions": [
      {
        "lessThan": "11.3.28",
        "status": "affected",
        "version": "11.3",
        "versionType": "custom"
      },
      {
        "lessThan": "11.4.200",
        "status": "affected",
        "version": "11.4",
        "versionType": "custom"
      },
      {
        "lessThan": "11.5.3",
        "status": "affected",
        "version": "11.5",
        "versionType": "custom"
      }
    ]
  }
]

References

kc.mcafee.com/corporate/index?page=content&id=SB10326

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2020-7301