title: Blind SQL injection in DLP ePO extension
description: SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation.
problem types: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
affected:
{
product: McAfee Data Loss Prevention (DLP) ePO Extension
vendor: McAfee,LLC
versions:
lessThan: 11.8.100, status: affected, version: 11.8.x, versionType: custom
lessThan: 11.7.101, status: affected, version: 11.7.x, versionType: custom
lessThan: 11.6.401, status: affected, version: 11.6.x, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
version: 3.1
]