CVE-2020-24560

Опубликовано: 24 сент. 2020

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-295: Improper server certificate verification in the communication with the update server.

Ссылки

https://helpcenter.trendmicro.com/en-us/article/TMKA-09890
Vendor Advisory
https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673
Vendor Advisory
https://jvn.jp/en/jp/JVN60093979/
Third Party Advisory
https://jvn.jp/jp/JVN60093979/
Third Party Advisory
https://helpcenter.trendmicro.com/en-us/article/TMKA-09890
Vendor Advisory
https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673
Vendor Advisory
https://jvn.jp/en/jp/JVN60093979/
Third Party Advisory
https://jvn.jp/jp/JVN60093979/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:trendmicro:antivirus\+_2019:*:*:*:*:*:*:*:*

Версия до 15.0 (включая)

cpe:2.3:a:trendmicro:internet_security_2019:*:*:*:*:*:*:*:*

Версия до 15.0 (включая)

cpe:2.3:a:trendmicro:maximum_security_2019:*:*:*:*:*:*:*:*

Версия до 15.0 (включая)

cpe:2.3:a:trendmicro:officescan_cloud:15:*:*:*:*:*:*:*

cpe:2.3:a:trendmicro:premium_security_2019:*:*:*:*:*:*:*:*

Версия до 15.0 (включая)

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 44%

0.00221

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-5gc2-xc6c-wh7r

github

больше 3 лет назад

EPSS

Процентиль: 44%

0.00221

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-295