Read the docs
TI-2020-05907 Aliases CVE-2020-7302GHSA-xh52-6wwc-2j2x

DLP ePO extension - Unrestricted Upload of File with Dangerous Type

Priority LOW 30CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

Unrestricted Upload of File with Dangerous Type in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.5.3 allows authenticated attackers to upload malicious files to the DLP case management section via lack of sanity checking.

Why it matters now

EPSS 0.00697 53rd percentileScored 2026-11-07
Fix Fixed DLP ePO extension (McAfee): 11.3.28, 11.4.200, 11.5.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeDLP ePO extension11.3 to before 11.3.28; 11.4 to before 11.4.200; 11.5 to before 11.5.311.3.28, 11.4.200, 11.5.3Patch availableCNA
  • DLP ePO extension VendorMcAfee Affected 11.3 to before 11.3.28; 11.4 to before 11.4.200; 11.5 to before 11.5.3 Fixed in 11.3.28, 11.4.200, 11.5.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:*11.3.0 to before 11.3.28; 11.4.0 to before 11.4.200; 11.5.0 to before 11.5.3VulnerableMcAfee
  • cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:*:*:* Versions 11.3.0 to before 11.3.28; 11.4.0 to before 11.4.200; 11.5.0 to before 11.5.3 Vulnerable ·McAfee

Remediation

  • Fix · CNA DLP ePO extension (McAfee) Fixed in 11.3.28, 11.4.200, 11.5.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    McAfee DLP ePO extension 11.3.28, 11.4.200, 11.5.3

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2020-05909 DLP ePO extension - Cross-site request forgeryPriority LOW 34
    • TI-2020-05910 DLP ePO extension - Privilege escalationPriority LOW 32
    • TI-2020-05908 DLP ePO extension - Cross-site scriptingPriority LOW 20
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7302
  2. 2026-10-03 Alias added: GHSA-xh52-6wwc-2j2x

References

Other 1

  • TI-2021-02968 Blind SQL injection in DLP ePO extension CVSS 3.1HIGH 8.4
  • TI-2020-05943 Privilege escalation in McAfee DLP Endpoint for Windows CVSS 3.1HIGH 7.8
  • TI-2020-05909 DLP ePO extension - Cross-site request forgery CVSS 3.1HIGH 7.6
  • TI-2020-05910 DLP ePO extension - Privilege escalation CVSS 3.1MEDIUM 6.7
  • TI-2020-05905 DLP ePO extension - Improper Authorization CVSS 3.1MEDIUM 6.3
  • TI-2019-02683 Data Loss Prevention - Unprotected Transport of Credentials CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences