1. CVE-Search
  2. CVE-2022-1700
ID CVE-2022-1700
Summary Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20, 2022. The XML parser in the Policy Engine was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. This issue affects: Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2. Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2. Forcepoint Web Security Content Gateway versions prior to 8.5.5. Forcepoint Email Security with DLP enabled versions prior to 8.5.5. Forcepoint Cloud Security Gateway prior to June 20, 2022.
References
Vulnerable Configurations
  • cpe:2.3:a:forcepoint:cloud_security_gateway:*:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:cloud_security_gateway:*:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:7.6:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:7.6:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:7.7:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:7.7:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:7.7.3:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:7.7.3:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:7.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:7.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:7.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:7.8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:7.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:7.8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:7.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:7.8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:8.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:8.1:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:8.2:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:8.3:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:8.4:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:8.5:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:8.5:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:8.5.3:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:8.5.3:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:email_security:8.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:email_security:8.5.4:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:one_endpoint_with_policy_engine:*:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:one_endpoint_with_policy_engine:*:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:data_loss_prevention:8.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:data_loss_prevention:8.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:web_security_content_gateway:-:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:web_security_content_gateway:-:*:*:*:*:*:*:*
  • cpe:2.3:a:forcepoint:web_security_content_gateway:8.5.4:*:*:*:*:*:*:*
    cpe:2.3:a:forcepoint:web_security_content_gateway:8.5.4:*:*:*:*:*:*:*
CVSS
Base: None
Impact:
Exploitability:
CWE CWE-611
CAPEC
  • XML External Entities Blowup
    This attack takes advantage of the entity replacement property of XML where the value of the replacement is a URI. A well-crafted XML document could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.
Access
VectorComplexityAuthentication
Impact
ConfidentialityIntegrityAvailability
Last major update 15-09-2022 - 18:05
Published 12-09-2022 - 19:15
Last modified 15-09-2022 - 18:05
Back to Top