Read the docs
TI-2021-02968 Aliases CVE-2021-4088GHSA-h23x-m73w-q96c

Blind SQL injection in DLP ePO extension

Priority MEDIUM 41CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation.

Why it matters now

EPSS 0.02254 83rd percentileScored 2026-11-07
Fix Fixed McAfee Data Loss Prevention (DLP) ePO Extension (McAfee,LLC): 11.8.100, 11.7.101, 11.6.401

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
McAfeeMcAfee Data Loss Prevention (DLP) ePO Extension11.8.x to before 11.8.100; 11.7.x to before 11.7.101; 11.6.x to before 11.6.40111.8.100, 11.7.101, 11.6.401Patch availableCNA
  • McAfee Data Loss Prevention (DLP) ePO Extension VendorMcAfee Affected 11.8.x to before 11.8.100; 11.7.x to before 11.7.101; 11.6.x to before 11.6.401 Fixed in 11.8.100, 11.7.101, 11.6.401 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:epolicy_orchestrator:*:*11.7.0 to before 11.7.101; 11.8.0 to before 11.8.100VulnerableMcAfee
cpe:2.3:a:mcafee:data_loss_prevention:11.6.401:*:*:*:*:epolicy_orchestrator:*:*11.6.401VulnerableMcAfee
  • cpe:2.3:a:mcafee:data_loss_prevention:*:*:*:*:*:epolicy_orchestrator:*:* Versions 11.7.0 to before 11.7.101; 11.8.0 to before 11.8.100 Vulnerable ·McAfee
  • cpe:2.3:a:mcafee:data_loss_prevention:11.6.401:*:*:*:*:epolicy_orchestrator:*:* Versions 11.6.401 Vulnerable ·McAfee

Remediation

  • Fix · CNA McAfee Data Loss Prevention (DLP) ePO Extension (McAfee,LLC) Fixed in 11.8.100, 11.7.101, 11.6.401

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4088
  2. 2026-10-03 Alias added: GHSA-h23x-m73w-q96c

References

Other 1

  • TI-2020-05943 Privilege escalation in McAfee DLP Endpoint for Windows CVSS 3.1HIGH 7.8
  • TI-2020-05909 DLP ePO extension - Cross-site request forgery CVSS 3.1HIGH 7.6
  • TI-2020-05910 DLP ePO extension - Privilege escalation CVSS 3.1MEDIUM 6.7
  • TI-2020-05907 DLP ePO extension - Unrestricted Upload of File with Dangerous Type CVSS 3.1MEDIUM 6.4
  • TI-2020-05905 DLP ePO extension - Improper Authorization CVSS 3.1MEDIUM 6.3
  • TI-2019-02683 Data Loss Prevention - Unprotected Transport of Credentials CVSS 3.1MEDIUM 6.5
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences