Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Data Loss Prevention (DLP)
Vendor
Forcepoint
Product
Data Loss Prevention (DLP)
Platforms
Unknown
Default status
Unknown
Data Loss Prevention (DLP) · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
unspecified
affected
custom
8.8.2
Unavailable
None listed
One Endpoint (F1E) with Policy Engine
Vendor
Forcepoint
Product
One Endpoint (F1E) with Policy Engine
Platforms
Unknown
Default status
Unknown
One Endpoint (F1E) with Policy Engine · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
unspecified
affected
custom
8.8.2
Unavailable
None listed
Web Security Content Gateway
Vendor
Forcepoint
Product
Web Security Content Gateway
Platforms
Unknown
Default status
Unknown
Web Security Content Gateway · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
unspecified
affected
custom
8.5.5
Unavailable
None listed
Email Security with DLP enabled
Vendor
Forcepoint
Product
Email Security with DLP enabled
Platforms
Unknown
Default status
Unknown
Email Security with DLP enabled · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
unspecified
affected
custom
8.5.5
Unavailable
None listed
Cloud Security Gateway
Vendor
Forcepoint
Product
Cloud Security Gateway
Platforms
Unknown
Default status
Unknown
Cloud Security Gateway · Scoped product and version facts