CVE-2024-0310

A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the response header parameter setting to switch the content security policy into report-only mode, allowing an attacker to bypass the content-security-policy configuration.

Score

CVSS 3.1 6.1 Medium

Status

Modified - trellixpsirt@trellix.com

Published

2024-01-10

Last modified

2024-09-03

Weaknesses

CWE-79

Affected products

• Endpoint Security (Trellix)
• Endpoint Security Web Control (Trellix)
• Trellix Endpoint Security Ens Web Control (Trellix)

References

• https://kcm.trellix.com/corporate/index?page=content&id=SB10417