CVE-2017-3948: McAfee Data Loss Prevention Endpoint

Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days.

Cross Site Scripting (XSS) in IMG Tags in the ePO extension in McAfee Data Loss Prevention Endpoint (DLP Endpoint) 10.0.x allows authenticated users to inject arbitrary web script or HTML via injecting malicious JavaScript into a user's browsing session.

Affected products

• McAfee Data Loss Prevention Endpoint: version 10.0 only; version 10.0.100 only; version 10.0.200 only; version 10.0.230 only; version 10.0.250 only

Published 2017-06-23. Last modified 2026-06-17.