CVE-2021-4088: 
McAfee DLP Endpoint Agent vulnerability analysis and mitigation

CVE-2021-4088 is a SQL injection vulnerability affecting the Data Loss Protection (DLP) ePO extension versions 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401. The vulnerability was disclosed on January 24, 2022, and impacts Trellix (formerly McAfee) DLP products (NVD).

The vulnerability allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. The vulnerability has been assigned a CVSS v3.1 base score of 7.2 (High) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The attack vector is network-based, requires high privileges but no user interaction, and can impact confidentiality, integrity, and availability at a high level (NVD).

If successfully exploited, this vulnerability could lead to remote code execution on the ePO server with privilege escalation. The impact affects all three main security aspects - confidentiality, integrity, and availability - at a high severity level (NVD).

The vulnerability requires network access and high privileges to exploit, though it does not require user interaction. The attack complexity is rated as low, indicating that the attack can be performed with relative ease once the necessary privileges are obtained (AttackerKB).

Users should upgrade to DLP ePO extension version 11.8.100 or later for the 11.8.x branch, version 11.7.101 or later for the 11.7.x branch, or upgrade from version 11.6.401 to a patched version (NVD).