CVE-2020-7304: 
McAfee DLP Endpoint Agent vulnerability analysis and mitigation

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in McAfee Data Loss Prevention (DLP) ePO extension versions prior to 11.5.3. The vulnerability was assigned CVE-2020-7304 and was disclosed on August 12, 2020. The affected software includes McAfee DLP versions from 11.3.0 up to 11.5.3 (NVD).

The vulnerability allows an authenticated remote attacker to embed a CSRF script through the process of adding a new label. The severity of this vulnerability is rated as HIGH with a CVSS v3.1 base score of 7.6 (Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). The weakness is categorized as CWE-352 (Cross-Site Request Forgery) (NVD).

If successfully exploited, this vulnerability could allow an attacker to achieve high levels of confidentiality and integrity compromise, with low impact on availability. The attack requires low attack complexity and low privileges, but is limited to adjacent network access (NVD).

The vulnerability requires an authenticated user with adjacent network access to exploit. The attack complexity is considered low, and no user interaction is required for exploitation (NVD).

The recommended mitigation is to upgrade to McAfee Data Loss Prevention (DLP) ePO extension version 11.5.3 or later (Trellix Advisory).