CVE-2021-31832: Cross site scripting vulnerability in DLP Endpoint for Windows
Improper Neutralization of Input in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200 allows a remote ePO DLP administrator to inject JavaScript code into the alert configuration text field. This JavaScript will be executed when an end user triggers a DLP policy on their machine.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-31832?
CVE-2021-31832 is a vulnerability in the ePO administrator extension for McAfee Data Loss Prevention (DLP) Endpoint for Windows prior to 11.6.200.
What is the severity of CVE-2021-31832?
CVE-2021-31832 has a severity of medium (4.8 out of 10).
How does CVE-2021-31832 affect the ePO administrator extension for McAfee Data Loss Prevention?
CVE-2021-31832 allows a remote ePO DLP administrator to inject JavaScript code into the alert configuration text field, which will be executed when an end user accesses the affected system.
What is the affected version of McAfee Data Loss Prevention?
McAfee Data Loss Prevention versions prior to 11.6.200 are affected by CVE-2021-31832.
How can I fix CVE-2021-31832?
To fix CVE-2021-31832, it is recommended to upgrade to McAfee Data Loss Prevention Endpoint version 11.6.200 or later.