title: DLP ePO extension - Cross site scripting
description: Cross Site scripting vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to trigger alerts via the file upload tab in the DLP case management section.
problem types: CWE-79 Cross-site Scripting (XSS)
affected:
{
product: DLP ePO extension
vendor: McAfee
versions:
lessThan: 11.3.28, status: affected, version: 11.3, versionType: custom
lessThan: 11.4.200, status: affected, version: 11.4, versionType: custom
lessThan: 11.5.3, status: affected, version: 11.5, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
]