PT-2019-3091 · Mcafee · Mcafee Data Loss Prevention

Publicado 2019-07-23 · Atualizado 2019-07-26 · CVE-2019-3591

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention (DLPe) for Windows versions prior to 11.3.0

Description The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows an unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website. The JavaScript is rendered as an XSS when the DLP Admin views the event in the ePO UI.

Recommendations For versions prior to 11.3.0, update to version 11.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ePO UI to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-03074

CVE-2019-3591

Produtos afetados

Mcafee Data Loss Prevention

Referências · 7

• https://kc.mcafee.com/corporate/index?page=content&id=SNS2088 · Nota
• https://bdu.fstec.ru/vul/2019-03074 · Nota de Segurança
• https://kc.mcafee.com/corporate/index?page=content&id=SNS2088 · Nota
• http://securityfocus.com/bid/109377 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-3591 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3591 · Aviso do Fabricante
• https://kc.mcafee.com/corporate/index?page=content&id=SB10289 · Nota