1. Home
  2. CVE Database
  3. CVE-2021-31832
MEDIUM · 5.2

CVE-2021-31832

Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject JavaScr...

Vulnerability Description

Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject JavaScript code into the alert configuration text field. This JavaScript will be executed when an end user triggers a DLP policy on their machine.

CVSS Score

5.2

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
McafeeData Loss Prevention< 11.6.200

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2021-31832?

CVE-2021-31832 is a vulnerability with a CVSS score of 5.2 (MEDIUM). Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject JavaScr...

How severe is CVE-2021-31832?

CVE-2021-31832 has been rated MEDIUM with a CVSS base score of 5.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2021-31832?

Check the references section above for vendor advisories and patch information. Affected products include: Mcafee Data Loss Prevention.