XXE in Forcepoint Cloud Security Gateway
CVE-2022-1700
Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine of Forcepoint Data Loss Prevention (DLP), which is also leveraged by Forcepoint One Endpoint (F1E), Web Security Content Gateway, Email Securi…
Vulnerability class: XXE (XML External Entity)
EPSS: 0.007 (49.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Forcepoint Cloud Security Gateway — versions prior to June 20, 2022
- Forcepoint Cloud_security_gateway
- Forcepoint Data_loss_prevention
- Forcepoint Data Loss Prevention (Dlp) — versions unspecified
- Forcepoint Email_security
- Forcepoint Email Security With Dlp Enabled — versions unspecified
- Forcepoint One Endpoint (F1e) With Policy Engine — versions unspecified
- Forcepoint One_endpoint_with_policy_engine
- Forcepoint Web Security Content Gateway — versions unspecified
- Forcepoint Web_security_content_gateway
Weakness classification (CWE)
References
- psirt@forcepoint.com (x_refsource_MISC, Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-1700?
- CVE-2022-1700 is a high-severity vulnerability in Forcepoint Cloud Security Gateway, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 7.5/10. Published 2022-09-12.
- How severe is CVE-2022-1700?
- High severity. CVSS v3 base score is 7.5 out of 10.