CVE-2020-15604

Опубликовано: 24 сент. 2020

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-494: Update files are not properly verified.

Ссылки

https://helpcenter.trendmicro.com/en-us/article/TMKA-09890
Vendor Advisory
https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673
Vendor Advisory
https://jvn.jp/en/jp/JVN60093979/
Third Party Advisory
https://jvn.jp/jp/JVN60093979/
Third Party Advisory
https://helpcenter.trendmicro.com/en-us/article/TMKA-09890
Vendor Advisory
https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673
Vendor Advisory
https://jvn.jp/en/jp/JVN60093979/
Third Party Advisory
https://jvn.jp/jp/JVN60093979/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:trendmicro:antivirus\+_2019:*:*:*:*:*:*:*:*

Версия до 15.0 (включая)

cpe:2.3:a:trendmicro:internet_security_2019:*:*:*:*:*:*:*:*

Версия до 15.0 (включая)

cpe:2.3:a:trendmicro:maximum_security_2019:*:*:*:*:*:*:*:*

Версия до 15.0 (включая)

cpe:2.3:a:trendmicro:officescan_cloud:15:*:*:*:*:*:*:*

cpe:2.3:a:trendmicro:premium_security_2019:*:*:*:*:*:*:*:*

Версия до 15.0 (включая)

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 46%

0.00232

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-h6wp-6m5m-gc8m

github

больше 3 лет назад

EPSS

Процентиль: 46%

0.00232

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-295