PT-2020-5830 · Mcafee · Mcafee Data Loss Prevention (Dlp) Epo Extension
Published
2020-08-12
·
Updated
2020-08-18
·
CVE-2020-7302
CVSS v3.1
6.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions:
McAfee Data Loss Prevention ePO extension versions prior to 11.5.3
Description:
The issue is related to an unrestricted upload of files with dangerous types in the ePolicy Orchestrator extension of McAfee Data Loss Prevention. This could allow a remote attacker to upload malicious files. The exploitation is possible due to a lack of sanity checking, enabling authenticated attackers to upload harmful files to the DLP case management section.
Recommendations:
For versions prior to 11.5.3, update to version 11.5.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the file upload functionality in the DLP case management section to minimize the risk of exploitation.
Fix
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mcafee Data Loss Prevention (Dlp) Epo Extension