Lucene search

TrellixCVE-2021-31832

HistoryJun 09, 2021 - 2:15 p.m.

CVE-2021-31832

2021-06-0914:15:09

CWE-79

trellix

web.nvd.nist.gov

cve-2021-31832

mcafee

data loss prevention

dlp

security vulnerability

input neutralization

nvd

epo administrator extension

javascript injection

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.2

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject JavaScript code into the alert configuration text field. This JavaScript will be executed when an end user triggers a DLP policy on their machine.

Affected configurations

Nvd

Node

mcafeedata_loss_preventionRange<11.6.200windows

VendorProductVersionCPE
mcafeedata_loss_prevention*cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:windows:*:*

Vendor	Product	Version	CPE
mcafee	data_loss_prevention	*	cpe:2.3:a:mcafee:data_loss_prevention::::::windows::*

CNA Affected

[
  {
    "product": "McAfee Data Loss Prevention (DLP) Endpoint for Windows",
    "vendor": "McAfee,LLC",
    "versions": [
      {
        "lessThan": "11.6.200",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

kc.mcafee.com/corporate/index?page=content&id=SB10360

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.2

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N

AI Score

5.2

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2021-31832