CVE-2021-31845 - CVE House
Back to Database
Status published High CVE-2021-31845

Remote Code Execution in McAfee DLP Discover

Vulnerability Description

A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Discover prior to 11.6.100 allows an attacker in the same network as the DLP Discover to execute arbitrary code through placing carefully constructed Ami Pro (.sam) files onto a machine and having DLP Discover scan it, leading to remote code execution with elevated privileges. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-31845

Credits & Attribution

No credits recorded in the NVD database.

References

More from McAfee,LLC

View All →
CVE-2022-1824
McAfee MCPR privilege escalation
High 7.9
CVE-2022-1823
McAfee MCPR privilege escalation
High 7.9
CVE-2022-1258
SQL injection vulnerability in McAfee Agent's ePO extension
High 8.4
CVE-2022-1257
Improper Verification of Cryptographic Signature by McAfee Agent
Medium 6.1
CVE-2022-1256
Improper Privilege Management in McAfee Agent for Windows
High 7.8

Affected Vendor

Affected Software

McAfee Data Loss Prevention (DLP) Discover
Vulnerable Versions:
unspecified

Timeline

Official Publish: September 17th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-120

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control