Lucene search

TrendmicroCVE-2020-28582

HistoryDec 01, 2020 - 7:15 p.m.

CVE-2020-28582

2020-12-0119:15:12

trendmicro

web.nvd.nist.gov

cve-2020-28582

information disclosure

vulnerability

trend micro

apex one

officescan xg

sp1

unauthenticated access

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.012

Percentile

85.4%

JSON

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal number of managed agents.

Affected configurations

Nvd

Node

trendmicroapex_oneMatch2019

trendmicroofficescanMatchxgsp1

VendorProductVersionCPE
trendmicroapex_one2019cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*
trendmicroofficescanxgcpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	apex_one	2019	cpe:2.3:a:trendmicro:apex_one:2019:::::::*
trendmicro	officescan	xg	cpe:2.3:a:trendmicro:officescan:xg:sp1::::::

CNA Affected

[
  {
    "product": "Trend Micro Apex One",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "2019"
      }
    ]
  },
  {
    "product": "Trend Micro OfficeScan",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "XG SP1"
      }
    ]
  }
]

References

success.trendmicro.com/solution/000281947

success.trendmicro.com/solution/000281949

www.zerodayinitiative.com/advisories/ZDI-20-1386/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.1

Confidence

High

EPSS

0.012

Percentile

85.4%

JSON

Related for CVE-2020-28582