CVE-2015-2873

2015-08-2315:59:00

CWE-425

[email protected]

web.nvd.nist.gov

cve-2015-2873

trend micro

deep discovery inspector

ddi

remote attack

sensitive information disclosure

configuration change

nvd

6.2 Medium

AI Score

Confidence

Low

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

0.001 Low

EPSS

Percentile

49.6%

JSON

Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct request to the (1) system log URL, (2) whitelist URL, or (3) blacklist URL.

CPENameOperatorVersion
trendmicro:deep_discovery_inspectortrendmicro deep discovery inspectoreq3.5
trendmicro:deep_discovery_inspectortrendmicro deep discovery inspectoreq3.6
trendmicro:deep_discovery_inspectortrendmicro deep discovery inspectoreq3.7
trendmicro:deep_discovery_inspectortrendmicro deep discovery inspectoreq3.8

CPE	Name	Operator	Version
trendmicro:deep_discovery_inspector	trendmicro deep discovery inspector	eq	3.5
trendmicro:deep_discovery_inspector	trendmicro deep discovery inspector	eq	3.6
trendmicro:deep_discovery_inspector	trendmicro deep discovery inspector	eq	3.7
trendmicro:deep_discovery_inspector	trendmicro deep discovery inspector	eq	3.8