CVE-2020-27018

Опубликовано: 09 нояб. 2020

Источник: nvd

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authenticated attacker to abuse the product's web server and grant access to web resources or parts of local files. An attacker must already have obtained authenticated privileges on the product to exploit this vulnerability.

Ссылки

https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/
Exploit
Third Party Advisory
https://success.trendmicro.com/solution/000279833
Exploit
Vendor Advisory
https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/
Exploit
Third Party Advisory
https://success.trendmicro.com/solution/000279833
Exploit
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:trendmicro:interscan_messaging_security_virtual_appliance:*:*:*:*:*:*:*:*

Версия до 9.1 (включая)

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 34%

0.00137

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-918

Связанные уязвимости

GHSA-h8rc-vwv6-26wf

github

больше 3 лет назад