CVE-2021-4088: Blind SQL injection in DLP ePO extension
SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-4088?
CVE-2021-4088 is a SQL injection vulnerability in the Data Loss Protection (DLP) ePO extension.
How does CVE-2021-4088 affect the affected software?
CVE-2021-4088 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database, potentially leading to remote code execution on the ePO server.
What is the severity of CVE-2021-4088?
The severity of CVE-2021-4088 is high with a CVSS score of 7.2.
How can I fix CVE-2021-4088?
To fix CVE-2021-4088, update the Data Loss Prevention (DLP) ePO extension to version 11.8.100, 11.7.101, or 11.6.401 depending on the affected version.
Where can I find more information about CVE-2021-4088?
You can find more information about CVE-2021-4088 at the following link: [McAfee Security Bulletin SB10376](https://kc.mcafee.com/corporate/index?page=content&id=SB10376)