PT-2019-3091 · Mcafee · Mcafee Data Loss Prevention

Published 2019-07-23 · Updated 2019-07-26 · CVE-2019-3591

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions McAfee Data Loss Prevention (DLPe) for Windows versions prior to 11.3.0

Description The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. This allows an unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website. The JavaScript is rendered as an XSS when the DLP Admin views the event in the ePO UI.

Recommendations For versions prior to 11.3.0, update to version 11.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the ePO UI to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2019-03074

CVE-2019-3591

Affected Products

Mcafee Data Loss Prevention

References · 7

• https://bdu.fstec.ru/vul/2019-03074 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-3591 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3591 · Vendor Advisory
• https://kc.mcafee.com/corporate/index?page=content&id=SNS2088 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SNS2088 · Note
• http://securityfocus.com/bid/109377 · Note
• https://kc.mcafee.com/corporate/index?page=content&id=SB10289 · Note