CVE-2019-3591

CWE-79 — Cross-site Scripting (XSS)3 documents3 sources

Severity

6.1MEDIUM

EPSS

0.2%

top 63.07%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mcafee, LLC Data Loss Prevention EPO Extension Mcafee Data Loss Prevention Endpoint

Timeline

PublishedJul 24

Latest updateMay 24

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NExploitability: 1.3 | Impact: 2.5

Affected Packages2 packages

▶CVEListV5mcafee,_llc/data_loss_prevention_epo_extension11.x — 11.3.0

▶NVDmcafee/data_loss_prevention_endpoint11.0 — 11.1.200+1

🔴Vulnerability Details

GHSA

GHSA-59jw-h7c8-p754: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Window↗2022-05-24

▶

CVEList

DLP Endpoint ePO extension vulnerable to XSS↗2019-07-24

▶