title: DLP ePO extension - Unrestricted Upload of File with Dangerous Type
description: Unrestricted Upload of File with Dangerous Type in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to upload malicious files to the DLP case management section via lack of sanity checking.
problem types: CWE-434 Unrestricted Upload of File with Dangerous Type
affected:
{
product: DLP ePO extension
vendor: McAfee
versions:
lessThan: 11.3.28, status: affected, version: 11.3, versionType: custom
lessThan: 11.4.200, status: affected, version: 11.4, versionType: custom
lessThan: 11.5.3, status: affected, version: 11.5, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
version: 3.1
]