Vulnerabilities > CVE-2022-2330 - XXE vulnerability in Mcafee Data Loss Prevention Endpoint

CVSS 6.5 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

mcafee

CWE-611

NVD

Published: 2022-08-30

Updated: 2023-11-15

Summary

Improper Restriction of XML External Entity Reference vulnerability in DLP Endpoint for Windows prior to 11.9.100 allows a remote attacker to cause the DLP Agent to access a local service that the attacker wouldn't usually have access to via a carefully constructed XML file, which the DLP Agent doesn't parse correctly.

Vulnerable Configurations

Part	Description	Count
Application	Mcafee Mcafee Data Loss Prevention Endpoint 9.3.0 Mcafee Data Loss Prevention Endpoint 9.3.1 Mcafee Data Loss Prevention Endpoint 9.3.2 Mcafee Data Loss Prevention Endpoint 9.3.3 Mcafee Data Loss Prevention Endpoint 9.3.4 Mcafee Data Loss Prevention Endpoint 9.3.5 Mcafee Data Loss Prevention Endpoint 9.3.6 Mcafee Data Loss Prevention Endpoint 9.3.100 Mcafee Data Loss Prevention Endpoint 9.3.150 Mcafee Data Loss Prevention Endpoint 9.3.200 Mcafee Data Loss Prevention Endpoint 9.3.300 Mcafee Data Loss Prevention Endpoint 9.3.400 Mcafee Data Loss Prevention Endpoint 9.3.500 Mcafee Data Loss Prevention Endpoint 9.3.600 Mcafee Data Loss Prevention Endpoint 9.3.633.3 Mcafee Data Loss Prevention Endpoint 9.4.0 Mcafee Data Loss Prevention Endpoint 9.4.02 Mcafee Data Loss Prevention Endpoint 9.4.2 Mcafee Data Loss Prevention Endpoint 9.4.100 Mcafee Data Loss Prevention Endpoint 9.4.103 Mcafee Data Loss Prevention Endpoint 9.4.200 Mcafee Data Loss Prevention Endpoint 9.4.241 Mcafee Data Loss Prevention Endpoint 9.4.241.32 Mcafee Data Loss Prevention Endpoint 9.4.301 Mcafee Data Loss Prevention Endpoint 10.0 Mcafee Data Loss Prevention Endpoint 10.0.100 Mcafee Data Loss Prevention Endpoint 10.0.200 Mcafee Data Loss Prevention Endpoint 10.0.230 Mcafee Data Loss Prevention Endpoint 10.0.250 Mcafee Data Loss Prevention Endpoint 10.0.330 Mcafee Data Loss Prevention Endpoint 10.0.350 Mcafee Data Loss Prevention Endpoint 10.0.400 Mcafee Data Loss Prevention Endpoint 10.0.500 Mcafee Data Loss Prevention Endpoint 10.0.505 Mcafee Data Loss Prevention Endpoint 10.0.510 Mcafee Data Loss Prevention Endpoint 11.0 Mcafee Data Loss Prevention Endpoint 11.0.0 Mcafee Data Loss Prevention Endpoint 11.0.200 Mcafee Data Loss Prevention Endpoint 11.0.300 Mcafee Data Loss Prevention Endpoint 11.0.400 Mcafee Data Loss Prevention Endpoint 11.0.500 Mcafee Data Loss Prevention Endpoint 11.0.600 Mcafee Data Loss Prevention Endpoint 11.0.700 Mcafee Data Loss Prevention Endpoint 11.1.0 Mcafee Data Loss Prevention Endpoint 11.1.100 Mcafee Data Loss Prevention Endpoint 11.1.200 Mcafee Data Loss Prevention Endpoint 11.1.210.32 Mcafee Data Loss Prevention Endpoint 11.2.000 Mcafee Data Loss Prevention Endpoint 11.2.0.4 Mcafee Data Loss Prevention Endpoint 11.2.0.142 Mcafee Data Loss Prevention Endpoint 11.3.0 Mcafee Data Loss Prevention Endpoint 11.3.2.82 Mcafee Data Loss Prevention Endpoint 11.4.0 Mcafee Data Loss Prevention Endpoint 11.4.200 Mcafee Data Loss Prevention Endpoint 11.4.300 Mcafee Data Loss Prevention Endpoint 11.5.0 Mcafee Data Loss Prevention Endpoint 11.6.0 Mcafee Data Loss Prevention Endpoint 11.6.100.41 Mcafee Data Loss Prevention Endpoint 11.6.600 Mcafee Data Loss Prevention Endpoint 11.9.0	66
OS	Microsoft Microsoft Windows -	1

Common Weakness Enumeration (CWE)

CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

References

https://kcm.trellix.com/corporate/index?page=content&id=SB10386