Lucene search

[email protected]CVE-2022-1700

HistorySep 12, 2022 - 7:15 p.m.

CVE-2022-1700

2022-09-1219:15:08

CWE-611

[email protected]

web.nvd.nist.gov

cve-2022-1700

xxe vulnerability

forcepoint

data loss prevention

f1e

web security

email security

cloud security gateway

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.3%

JSON

Improper Restriction of XML External Entity Reference (‘XXE’) vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.

Affected configurations

NVD

Node

forcepointcloud_security_gatewayRange<2022-06-20

forcepointdata_loss_preventionRange<8.8.2

forcepointemail_securityRange<8.5.5

forcepointone_endpoint_with_policy_engineRange<8.8.2

forcepointweb_security_content_gatewayRange<8.5.5

CPENameOperatorVersion
forcepoint:cloud_security_gatewayforcepoint cloud security gatewaylt2022-06-20
forcepoint:data_loss_preventionforcepoint data loss preventionlt8.8.2
forcepoint:email_securityforcepoint email securitylt8.5.5
forcepoint:one_endpoint_with_policy_engineforcepoint one endpoint with policy enginelt8.8.2
forcepoint:web_security_content_gatewayforcepoint web security content gatewaylt8.5.5

CPE	Name	Operator	Version
forcepoint:cloud_security_gateway	forcepoint cloud security gateway	lt	2022-06-20
forcepoint:data_loss_prevention	forcepoint data loss prevention	lt	8.8.2
forcepoint:email_security	forcepoint email security	lt	8.5.5
forcepoint:one_endpoint_with_policy_engine	forcepoint one endpoint with policy engine	lt	8.8.2
forcepoint:web_security_content_gateway	forcepoint web security content gateway	lt	8.5.5

CNA Affected

[
  {
    "product": "Data Loss Prevention (DLP)",
    "vendor": "Forcepoint",
    "versions": [
      {
        "lessThan": "8.8.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "One Endpoint (F1E) with Policy Engine",
    "vendor": "Forcepoint",
    "versions": [
      {
        "lessThan": "8.8.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Web Security Content Gateway",
    "vendor": "Forcepoint",
    "versions": [
      {
        "lessThan": "8.5.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Email Security with DLP enabled",
    "vendor": "Forcepoint",
    "versions": [
      {
        "lessThan": "8.5.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Cloud Security Gateway ",
    "vendor": "Forcepoint",
    "versions": [
      {
        "status": "affected",
        "version": "prior to June 20, 2022"
      }
    ]
  }
]

References

help.forcepoint.com/security/CVE/CVE-2022-1700.html

Social References

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.3%

JSON

Related for CVE-2022-1700

nvd1 cvelist1 prion1