CWE Code: 77
Vulnerability Type: privilege_escalation
CVSS Score: 4.4
CWE Name:  Improper Neutralization of Special Elements used in a Command ('Command Injection')
Summary: improper neutralization of special elements used in a command ('command injection') in epo extension in mcafee data loss prevention (dlp) 11.x prior to 11.3.0 allows authenticated adminstrator to execute arbitrary code with their local machine privileges via a specially crafted dlp policy, which is exported and opened on the their machine. in our checks, the user must explicitly allow the code to execute.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2019-07-24
Last Modified Date: 2019-10-09