Skip to content
CVE PROGRAM SOURCE RECORD8.4 High

CVE-2021-4088

Blind SQL injection in DLP ePO extension

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
trellix

Description

SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

McAfee,LLC McAfee Data Loss Prevention (DLP) ePO Extension

  • 11.8.x to < 11.8.100affected
  • 11.7.x to < 11.7.101affected
  • 11.6.x to < 11.6.401affected

References