CVE-2022-1700
Published: Sep 12, 2022
Modified: Aug 3, 2024
CVSS v3.1
7.5
Description
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.
| Vendor | Product | Versions |
|---|---|---|
Forcepoint | Data Loss Prevention (DLP) | affected unspecified - < 8.8.2 |
Forcepoint | One Endpoint (F1E) with Policy Engine | affected unspecified - < 8.8.2 |
Forcepoint | Web Security Content Gateway | affected unspecified - < 8.5.5 |
Forcepoint | Email Security with DLP enabled | affected unspecified - < 8.5.5 |
Forcepoint | Cloud Security Gateway | affected prior to June 20, 2022 |
Weaknesses (CWE)
CVSS v3.1 Details
CVSS v3.1 Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
References
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now