Lucene search

TrendmicroCVE-2020-8467

HistoryMar 18, 2020 - 1:15 a.m.

CVE-2020-8467

2020-03-1801:15:11

trendmicro

web.nvd.nist.gov

889

In Wild

cve-2020-8467

vulnerability

trend micro

apex one

officescan xg

migration tool

rce

user authentication

nvd

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.027

Percentile

90.6%

JSON

A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.

Affected configurations

Nvd

Node

trendmicroapex_oneMatch2019

trendmicroofficescanMatchxg

trendmicroofficescanMatchxgsp1

VendorProductVersionCPE
trendmicroapex_one2019cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*
trendmicroofficescanxgcpe:2.3:a:trendmicro:officescan:xg:*:*:*:*:*:*:*
trendmicroofficescanxgcpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	apex_one	2019	cpe:2.3:a:trendmicro:apex_one:2019:::::::*
trendmicro	officescan	xg	cpe:2.3:a:trendmicro:officescan:xg:::::::*
trendmicro	officescan	xg	cpe:2.3:a:trendmicro:officescan:xg:sp1::::::

CNA Affected

[
  {
    "product": "Trend Micro OfficeScan, Trend Micro Apex One",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "OfficeScan XG (12.0), Apex One 2019 (14.0)"
      }
    ]
  }
]

References

success.trendmicro.com/jp/solution/000244253

success.trendmicro.com/solution/000245571

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.027

Percentile

90.6%

JSON

Related for CVE-2020-8467