PT-2015-5875 · Mcafee · Mcafee Data Loss Prevention Endpoint+1

Publicado 2015-03-27 · Atualizado 2016-12-03 · CVE-2015-2759

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention Endpoint (DLPe) versions prior to 9.3 Patch 4 Hotfix 16 (9.3.416.4)

Description The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the ePO extension. These vulnerabilities allow remote attackers to hijack the authentication of users for requests, enabling them to obtain sensitive information or modify the database.

Recommendations For versions prior to 9.3 Patch 4 Hotfix 16 (9.3.416.4), update to version 9.3 Patch 4 Hotfix 16 (9.3.416.4) or later to resolve the issue. As a temporary workaround, consider restricting access to the ePO extension to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-2759

Produtos afetados

Mcafee Data Loss Prevention Endpoint

Epo

Referências · 3

• http://securityfocus.com/bid/73403 · Nota
• https://kc.mcafee.com/corporate/index?page=content&id=SB10111 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2759 · Nota de Segurança