Read the docs
TI-2022-02025 Aliases CVE-2022-2188GHSA-h7pw-cjr2-mh4p

DXL Broker privilege escalation vulnerability

Priority LOW 28CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory controls in the logs directory. This can lead to a denial-of-service attack on the DXL Broker.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00157 4th percentileScored 2026-11-07
Fix Fixed DXL Broker (Trellix): 6.0.0.280

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TrellixDXL Broker5.x to before 6.0.0.2806.0.0.280Patch availableCNA
  • DXL Broker VendorTrellix Affected 5.x to before 6.0.0.280 Fixed in 6.0.0.280 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mcafee:data_exchange_layer:*:*:*:*:*:*:*:*before 6.0.0.280VulnerableMcAfee
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:mcafee:data_exchange_layer:*:*:*:*:*:*:*:* Versions before 6.0.0.280 Vulnerable ·McAfee
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA DXL Broker (Trellix) Fixed in 6.0.0.280

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2188
  2. 2026-10-03 Alias added: GHSA-h7pw-cjr2-mh4p

References

Advisory 1

  • TI-2024-10633 OS command injection in Trellix Enterprise Security Manager CVSS 3.1CRITICAL 9.8
  • TI-2024-05266 Deserialization of untrusted data in Trellix Intrusion Prevention System Manager CVSS 3.1CRITICAL 9.8
  • TI-2024-10632 Path traversal in Trellix Enterprise Security Manager CVSS 3.1HIGH 8.2
  • TI-2023-05589 Command injection in Trellix ESM CVSS 3.1HIGH 8.4
  • TI-2023-03101 OS command injection in Trellix Enterprise Security Manager CVSS 3.1HIGH 8.8
  • TI-2023-05161 Path traversal in Trellix Application and Change Control CVSS 3.1HIGH 8.4
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences