description: Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.
problem types: CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
affected:
{
product: Data Loss Prevention (DLP)
vendor: Forcepoint
versions:
lessThan: 8.8.2, status: affected, version: unspecified, versionType: custom
}
{
product: One Endpoint (F1E) with Policy Engine
vendor: Forcepoint
versions:
lessThan: 8.8.2, status: affected, version: unspecified, versionType: custom
}
{
product: Web Security Content Gateway
vendor: Forcepoint
versions:
lessThan: 8.5.5, status: affected, version: unspecified, versionType: custom
}
{
product: Email Security with DLP enabled
vendor: Forcepoint
versions:
lessThan: 8.5.5, status: affected, version: unspecified, versionType: custom
}
{
product: Cloud Security Gateway
vendor: Forcepoint
versions:
status: affected, version: prior to June 20, 2022
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
]
solutions: Upgrade to the following versions:
Forcepoint Data Loss Prevention (DLP) versions 8.8.2 or above.
Forcepoint One Endpoint (F1E) with Policy Engine versions 8.8.2 or above.
Forcepoint Web Security Content Gateway versions 8.5.5 or above.
Forcepoint Email Security with DLP enabled versions 8.5.5 or above.
workarounds: See https://help.forcepoint.com/security/CVE/CVE-2022-1700.html