XML external entity injection in Forcepoint Data Loss Prevention
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Forcepoint | Data Loss Prevention (DLP) | before 8.8.2 | 8.8.2 | Patch available | CNA |
| Forcepoint | One Endpoint (F1E) with Policy Engine | before 8.8.2 | 8.8.2 | Patch available | CNA |
| Forcepoint | Web Security Content Gateway | before 8.5.5 | 8.5.5 | Patch available | CNA |
| Forcepoint | Email Security with DLP enabled | before 8.5.5 | 8.5.5 | Patch available | CNA |
| Forcepoint | Cloud Security Gateway | prior to June 20, 2022 | — | No fix listed | CNA |
- Data Loss Prevention (DLP) VendorForcepoint Affected before 8.8.2 Fixed in 8.8.2 Patch available CNA
- One Endpoint (F1E) with Policy Engine VendorForcepoint Affected before 8.8.2 Fixed in 8.8.2 Patch available CNA
- Web Security Content Gateway VendorForcepoint Affected before 8.5.5 Fixed in 8.5.5 Patch available CNA
- Email Security with DLP enabled VendorForcepoint Affected before 8.5.5 Fixed in 8.5.5 Patch available CNA
- Cloud Security Gateway VendorForcepoint Affected prior to June 20, 2022 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:forcepoint:cloud_security_gateway:*:*:*:*:*:*:*:* | before 2022-06-20 | Vulnerable | Forcepoint |
| cpe:2.3:a:forcepoint:data_loss_prevention:*:*:*:*:*:*:*:* | before 8.8.2 | Vulnerable | Forcepoint |
| cpe:2.3:a:forcepoint:email_security:*:*:*:*:*:*:*:* | before 8.5.5 | Vulnerable | Forcepoint |
| cpe:2.3:a:forcepoint:one_endpoint_with_policy_engine:*:*:*:*:*:*:*:* | before 8.8.2 | Vulnerable | Forcepoint |
| cpe:2.3:a:forcepoint:web_security_content_gateway:*:*:*:*:*:*:*:* | before 8.5.5 | Vulnerable | Forcepoint |
- cpe:2.3:a:forcepoint:cloud_security_gateway:*:*:*:*:*:*:*:* Versions before 2022-06-20 Vulnerable ·Forcepoint
- cpe:2.3:a:forcepoint:data_loss_prevention:*:*:*:*:*:*:*:* Versions before 8.8.2 Vulnerable ·Forcepoint
- cpe:2.3:a:forcepoint:email_security:*:*:*:*:*:*:*:* Versions before 8.5.5 Vulnerable ·Forcepoint
- cpe:2.3:a:forcepoint:one_endpoint_with_policy_engine:*:*:*:*:*:*:*:* Versions before 8.8.2 Vulnerable ·Forcepoint
- cpe:2.3:a:forcepoint:web_security_content_gateway:*:*:*:*:*:*:*:* Versions before 8.5.5 Vulnerable ·Forcepoint
Remediation
- Fix · CNA Data Loss Prevention (DLP) (Forcepoint) Fixed in 8.8.2
- Fix · CNA One Endpoint (F1E) with Policy Engine (Forcepoint) Fixed in 8.8.2
- Fix · CNA Web Security Content Gateway (Forcepoint) Fixed in 8.5.5
- Fix · CNA Email Security with DLP enabled (Forcepoint) Fixed in 8.5.5
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1700
- 2026-10-03 Alias added: GHSA-7358-ghcm-c3ff
References
More Forcepoint Cloud Security Gateway vulnerabilities
- TI-2023-11452 Cross-site scripting in Forcepoint Cloud Security Gateway CVSS 3.1MEDIUM 6.1
- TI-2023-11451 Cross-site scripting in Forcepoint Cloud Security Gateway CVSS 3.1MEDIUM 6.1
- TI-2023-11450 Cross-site scripting in Forcepoint Cloud Security Gateway CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-1700 · CVE Program
- CVE-2022-1700 · NVD
- FIRST EPSS
- GHSA-7358-ghcm-c3ff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences