CVE-2019-3591
DLP Endpoint ePO extension vulnerable to XSS
- State
- Published
- Severity
- 3.9 Low
- Published
- Jul 24, 2019
- Updated
- Aug 4, 2024
- Reserved
- Jan 3, 2019
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 3.9 Low | CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | trellix |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Data Loss Prevention ePO extensionMcAfee, LLC |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.