CVE-2021-31848 Data Loss Prevention (DLP) ePO extension - Cross site scripting (XSS)

What is CVE-2021-31848?

CVE-2021-31848 is a high-severity cross-site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension, published on 1 Nov 2021. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Cross site scripting (XSS) vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the DLP ePO extension.

Weakness: CWE-79

Which versions are affected by CVE-2021-31848?

It affects 1 product.

Products include Mcafee Data Loss Prevention Endpoint.

How do I fix CVE-2021-31848?

No fix has been published for CVE-2021-31848 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-31848 being exploited?

There is no known exploitation of CVE-2021-31848 in the wild and no public exploit code.

Other vulnerabilities in McAfee Data Loss Prevention (DLP) ePO extension

• CVE-2021-31849 Data Loss Prevention (DLP) ePO extension - SQL injection High 8.4
• CVE-2021-31844 Local Privilege Escalation in McAfee DLP Endpoint for Windows High 8.2
• CVE-2021-23887 Privilege escalation in McAfee DLP Endpoint for Windows High 7.8
• CVE-2016-8012 Privilege escalation in Data Loss Prevention Endpoint (DLPe) High 7.8
• CVE-2019-3622 DLP Endpoint log file redirection to arbitrary locations High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h28h-cmg9-rmpc.