Keval Shah

**Name of the Vulnerable Software and Affected Versions** Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2 Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2 Forcepoint Web Security Content Gateway versions prior to 8.5.5 Forcepoint Email Security with DLP enabled versions prior to 8.5.5 Forcepoint Cloud Security Gateway prior to June 20, 2022 **Description** The issue is related to an Improper Restriction of XML External Entity Reference ('XXE') vulnerability in the Policy Engine. The XML parser was found to be improperly configured to support external entities and external DTD (Document Type Definitions), which can lead to an XXE attack. **Recommendations** For Forcepoint Data Loss Prevention (DLP) versions prior to 8.8.2, update to version 8.8.2 or later. For Forcepoint One Endpoint (F1E) with Policy Engine versions prior to 8.8.2, update the Policy Engine to version 8.8.2 or later. For Forcepoint Web Security Content Gateway versions prior to 8.5.5, update to version 8.5.5 or later. For Forcepoint Email Security with DLP enabled versions prior to 8.5.5, update to version 8.5.5 or later. For Forcepoint Cloud Security Gateway prior to June 20, 2022, ensure that updates after June 20, 2022, are applied.

**Name of the Vulnerable Software and Affected Versions** Software (affected versions not specified) **Description** The issue arises from an XML external entity reference, where the software fails to use XML security flags when parsing XML in the backup/restore functionality. This oversight may lead to an XXE attack during the restoration of a backup. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenKM Community Edition versions 6.3.10 and earlier **Description** The issue allows an attacker to perform an XML external entity injection attack due to the use of the XMLReader parser in the XMLTextExtractor.java file without the required security flags. **Recommendations** For OpenKM Community Edition versions 6.3.10 and earlier, update to a version that includes the required security flags for the XMLReader parser in the XMLTextExtractor.java file.