McAfee Data Loss Prevention Endpoint Multiple Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	73403
Class:	Input Validation Error
CVE:	CVE-2015-2759
Remote:	Yes
Local:	No
Published:	Mar 27 2015 12:00AM
Updated:	Mar 27 2015 12:00AM
Credit:	François-Xavier Stellamans from NCI Agency - Cyber Security
Vulnerable:	McAfee ePolicy Orchestrator (ePO) 0 McAfee Data Loss Prevention Endpoint 9.3.400 McAfee Data Loss Prevention Endpoint 9.3.300 McAfee Data Loss Prevention Endpoint 9.3.200.23
Not Vulnerable:	McAfee Data Loss Prevention Endpoint 9.3.416.4

McAfee Data Loss Prevention Endpoint Multiple Cross Site Request Forgery Vulnerabilities

McAfee Data Loss Prevention Endpoint is prone to multiple cross-site request-forgery vulnerabilities.

An attacker can exploit these issues to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

McAfee Data Loss Prevention Endpoint Multiple Cross Site Request Forgery Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim to open a malicious URI.

McAfee Data Loss Prevention Endpoint Multiple Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

McAfee Data Loss Prevention Endpoint Multiple Cross Site Request Forgery Vulnerabilities

References:

• ePolicy Orchestrator Product Page (McAfee)
  
• McAfee Data Loss Prevention Endpoint Product Page (McAfee)
  
• McAfee Security Bulletin - Data Loss Prevention Endpoint ePO extension update fi (Mcafee)