✕
Request a Demo
Rewterz
Rewterz Threat Advisory – Multiple NetApp Vulnerabilities
November 3, 2021
Rewterz
Rewterz Threat Advisory – Multiple Mozilla Firefox Vulnerabilities
November 3, 2021

Rewterz Threat Advisory – Multiple McAfee Data Loss Prevention (DLP) ePO Extension

Severity

Medium

Analysis Summary

CVE-2021-31848

McAfee Data Loss Prevention (DLP) ePO extension is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the case management part. A remote authenticated attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim’s Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.

CVE-2021-31849 

McAfee Data Loss Prevention (DLP) ePO extension is vulnerable to SQL injection. A remote authenticated attacker could send specially-crafted SQL statements to the user management section, which could allow the attacker to view, add, modify or delete information in the back-end database.

Impact

  • Cross-Site Scripting
  • Data Manipulation

Affected Vendors

McAfee

Affected Products

  • McAfee Data Loss Prevention (DLP) ePO extension 11.6
  • McAfee Data Loss Prevention (DLP) ePO extension 11.7

Remediation

Refer to McAfee Security Advisory for patch, upgrade, or suggested workaround information.

https://kc.mcafee.com/corporate/index?page=content&id=SB10371