Is CVE-2019-3591 actively exploited?

No active exploitation of CVE-2019-3591 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-3591 be exploited remotely?

No. CVE-2019-3591 requires local access to exploit.

What is the CVSS score of CVE-2019-3591?

CVE-2019-3591 has a CVSS score of 3.9 (LOW).

HOME VULNERABILITIESCVE-2019-3591

LOW

CVE-2019-3591

CWE-79Published: July 24, 2019· Updated: Jun 17, 2026

3.9

CVSS v3.1

Official Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ePO extension in McAfee Data Loss Prevention (DLPe) for Windows 11.x prior to 11.3.0 allows unauthenticated remote user to trigger specially crafted JavaScript to render in the ePO UI via a carefully crafted upload to a remote website which is correctly blocked by DLPe Web Protection. This would then render as an XSS when the DLP Admin viewed the event in the ePO UI.

NVD Source

Technical Analysis

CVE-2019-3591 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.