CVE-2019-3591: DLP Endpoint ePO extension vulnerable to XSS

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-07-24 · updated 2026-06-17
Weakness: CWE-79

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.

Affected products

McAfee,LLC McAfee Data Loss Prevention (DLP) Endpoint for Windows: from 11.0 before 11.1.200; from 11.2.000 before 11.3.0 — fixed in 11.1.200, 11.3.0

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee Data Loss Prevention (DLP) Endpoint for Windows 11.1.200, 11.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-3591 or the next vulnerability affects your stack