Read the docs
TI-2019-02683 Aliases CVE-2019-3640GHSA-jcj2-r7jq-h3h2

Data Loss Prevention - Unprotected Transport of Credentials

Priority LOW 29CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.

Summary

Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secure connection when testing LDAP connectivity.

Why it matters now

EPSS 0.00528 44th percentileScored 2026-11-07
Fix Fixed Data Loss Prevention (McAfee): 11.4.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeData Loss Prevention11.x to before 11.4.011.4.0Patch availableCNA
  • Data Loss Prevention VendorMcAfee Affected 11.x to before 11.4.0 Fixed in 11.4.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:*11.0.0 – 11.4.0VulnerableMcAfee
  • cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:* Versions 11.0.0 – 11.4.0 Vulnerable ·McAfee

Remediation

  • Fix · CNA Data Loss Prevention (McAfee) Fixed in 11.4.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-3640
  2. 2026-10-03 Alias added: GHSA-jcj2-r7jq-h3h2

References

Other 1

  • TI-2021-02968 Blind SQL injection in DLP ePO extension CVSS 3.1HIGH 8.4
  • TI-2020-05943 Privilege escalation in McAfee DLP Endpoint for Windows CVSS 3.1HIGH 7.8
  • TI-2020-05909 DLP ePO extension - Cross-site request forgery CVSS 3.1HIGH 7.6
  • TI-2020-05910 DLP ePO extension - Privilege escalation CVSS 3.1MEDIUM 6.7
  • TI-2020-05907 DLP ePO extension - Unrestricted Upload of File with Dangerous Type CVSS 3.1MEDIUM 6.4
  • TI-2020-05905 DLP ePO extension - Improper Authorization CVSS 3.1MEDIUM 6.3
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences