CVE-2021-4088

Blind SQL injection in DLP ePO extension

State: Published
Severity: 8.4 High
Published: Jan 24, 2022
Updated: Aug 3, 2024
Reserved: Dec 9, 2021

Description

SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H	trellix

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
McAfee Data Loss Prevention (DLP) ePO ExtensionMcAfee,LLC	11.8.x to before 11.8.100Affected 11.7.x to before 11.7.101Affected 11.6.x to before 11.6.401Affected

References

https://kc.mcafee.com/corporate/index?page=content&id=SB10376

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.