Lucene search

TrendmicroCVE-2019-15627

HistoryOct 17, 2019 - 7:15 p.m.

CVE-2019-15627

2019-10-1719:15:10

CWE-59

trendmicro

web.nvd.nist.gov

trend micro

deep security

agent

vulnerability

file delete

attack

nvd

cve-2019-15627

CVSS2

6.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:C/A:C

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

29.8%

JSON

Versions 10.0, 11.0 and 12.0 of the Trend Micro Deep Security Agent are vulnerable to an arbitrary file delete attack, which may lead to availability impact. Local OS access is required. Please note that only Windows agents are affected.

Affected configurations

Nvd

Node

trendmicrodeep_securityMatch10.0

trendmicrodeep_securityMatch11.0

trendmicrodeep_securityMatch12.0

AND

microsoftwindowsMatch-

VendorProductVersionCPE
trendmicrodeep_security10.0cpe:2.3:a:trendmicro:deep_security:10.0:*:*:*:*:*:*:*
trendmicrodeep_security11.0cpe:2.3:a:trendmicro:deep_security:11.0:*:*:*:*:*:*:*
trendmicrodeep_security12.0cpe:2.3:a:trendmicro:deep_security:12.0:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	deep_security	10.0	cpe:2.3:a:trendmicro:deep_security:10.0:::::::*
trendmicro	deep_security	11.0	cpe:2.3:a:trendmicro:deep_security:11.0:::::::*
trendmicro	deep_security	12.0	cpe:2.3:a:trendmicro:deep_security:12.0:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "product": "Deep Security Agent",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "10.0"
      },
      {
        "status": "affected",
        "version": "11.0"
      },
      {
        "status": "affected",
        "version": "12.0"
      }
    ]
  }
]

References

packetstormsecurity.com/files/155579/Trend-Micro-Deep-Security-Agent-11-Arbitrary-File-Overwrite.html

success.trendmicro.com/solution/000149495

CVSS2

6.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:N/I:C/A:C

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.9

Confidence

High

EPSS

0.001

Percentile

29.8%

JSON

Related for CVE-2019-15627