CVE-2019-3595: mcafee, llc dlp endpoint epo extension OS Command Injection

Vulnerability summary

CVE-2019-3595 is a medium (CVSS 6.5) OS Command Injection vulnerability in mcafee, llc dlp endpoint epo extension. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.7% of scored vulnerabilities.

Timeline

1. 24-07-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection') in ePO extension in McAfee Data Loss Prevention (DLP) 11.x prior to 11.3.0 allows Authenticated Adminstrator to execute arbitrary code with their local machine privileges via a specially crafted DLP policy, which is exported and opened on the their machine. In our checks, the user must explicitly allow the code to execute.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.