McAfee ePO DLPe Extension < 9.3.416.4 Multiple Vulnerabilities (SB10111)
Medium Nessus Plugin ID 82620
SynopsisThe remote host is affected by multiple vulnerabilities.
DescriptionThe remote McAfee ePO server has a version of the McAfee Data Loss Protection Endpoint (DLPe) installed that is affected by multiple vulnerabilities :
- The ePO extension is affected by an unspecified denial of service vulnerability via a database lock or license corruption, which can be exploited by an authenticated, remote attacker. (CVE-2015-2757)
- An information disclosure vulnerability exists in the ePO extension that allows an authenticated, remote attacker to obtain sensitive information or modify the database by using a specially crafted URL.
- Multiple cross-site request forgery vulnerabilities exist in the ePO extension that allow a remote attacker to hijack the authentication of users, resulting in disclosure of sensitive information or modification of the database. (CVE-2015-2759)
- An unspecified cross-site scripting vulnerability exists in the ePO extension, which an authenticated, remote attacker can exploit to inject arbitrary script or HTML.
SolutionUpgrade to DLPe 9.3 Patch 4 Hotfix 16 (9.3.416.4) or later.