CVE-2019-3595: Command Injection in McAfee DLP Endpoint ePO

The primary impact of CVE-2019-3595 is the potential for arbitrary code execution on the administrator's machine. An attacker, posing as an authenticated administrator, can craft a malicious DLP policy, export it, and trick the administrator into opening it. Upon execution, the policy will inject and execute commands, granting the attacker control over the system with the administrator's privileges. This could lead to data theft, system compromise, or further lateral movement within the network. The requirement for explicit user approval to execute the code slightly mitigates the risk, but social engineering tactics could still be effective.

1. Reserved2019-01-03
2. Published2019-07-24
3. Modified2024-08-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2019-3595 is to upgrade the McAfee DLP Endpoint ePO extension to version 11.3.0 or later. Prior to upgrading, it is recommended to create a backup of the existing ePO configuration. If an upgrade is not immediately feasible, restrict administrator access to the ePO extension and closely monitor DLP policy exports for any suspicious activity. Consider implementing stricter DLP policy review processes to identify and prevent the deployment of malicious policies. There are no specific WAF or proxy rules that can directly address this vulnerability.