CVE-2019-9488 - Vulnerability Details

Vendors	Products
Trendmicro	Deep Security Manager Vulnerability Protection

Link	Providers
https://success.trendmicro.com/solution/1122900

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Trend Micro Deep Security", "vendor": "Trend Micro", "versions": [{"status": "affected", "version": "10.x"}, {"status": "affected", "version": "11.x"}]}, {"product": "Trend Micro Vulnerability Protection", "vendor": "Trend Micro", "versions": [{"status": "affected", "version": "2.0"}]}], "descriptions": [{"lang": "en", "value": "Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM)."}], "problemTypes": [{"descriptions": [{"description": "XXE Attack", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-09-11T18:00:08", "orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "shortName": "trendmicro"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://success.trendmicro.com/solution/1122900"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@trendmicro.com", "ID": "CVE-2019-9488", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Trend Micro Deep Security", "version": {"version_data": [{"version_value": "10.x"}, {"version_value": "11.x"}]}}, {"product_name": "Trend Micro Vulnerability Protection", "version": {"version_data": [{"version_value": "2.0"}]}}]}, "vendor_name": "Trend Micro"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "XXE Attack"}]}]}, "references": {"reference_data": [{"name": "https://success.trendmicro.com/solution/1122900", "refsource": "CONFIRM", "url": "https://success.trendmicro.com/solution/1122900"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T21:54:44.150Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://success.trendmicro.com/solution/1122900"}]}]}, "cveMetadata": {"assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272", "assignerShortName": "trendmicro", "cveId": "CVE-2019-9488", "datePublished": "2019-09-11T18:00:08", "dateReserved": "2019-03-01T00:00:00", "dateUpdated": "2024-08-04T21:54:44.150Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Trend Micro Deep Security (string)

vendor : Trend Micro (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.x (string)

}

1 : { »

status : affected (string)

version : 11.x (string)

}

]

}

1 : { »

product : Trend Micro Vulnerability Protection (string)

vendor : Trend Micro (string)

versions : [ »

0 : { »

status : affected (string)

version : 2.0 (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM). (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : XXE Attack (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2019-09-11T18:00:08 (string)

orgId : 7f7bd7df-cffe-4fdb-ab6d-859363b89272 (string)

shortName : trendmicro (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://success.trendmicro.com/solution/1122900 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : security@trendmicro.com (string)

ID : CVE-2019-9488 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Trend Micro Deep Security (string)

version : { »

version_data : [ »

0 : { »

version_value : 10.x (string)

}

1 : { »

version_value : 11.x (string)

}

]

}

1 : { »

product_name : Trend Micro Vulnerability Protection (string)

version : { »

version_data : [ »

0 : { »

version_value : 2.0 (string)

}

]

}

]

}

vendor_name : Trend Micro (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM). (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : XXE Attack (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://success.trendmicro.com/solution/1122900 (string)

refsource : CONFIRM (string)

url : https://success.trendmicro.com/solution/1122900 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-04T21:54:44.150Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://success.trendmicro.com/solution/1122900 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : 7f7bd7df-cffe-4fdb-ab6d-859363b89272 (string)

assignerShortName : trendmicro (string)

cveId : CVE-2019-9488 (string)

datePublished : 2019-09-11T18:00:08 (string)

dateReserved : 2019-03-01T00:00:00 (string)

dateUpdated : 2024-08-04T21:54:44.150Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:-:*:*:*:*:*:*", "matchCriteriaId": "591F99B9-037F-49F2-90C9-C9327465ED3C", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u1:*:*:*:*:*:*", "matchCriteriaId": "EF1D72E4-FDF6-42F2-9386-61EC30C1D211", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u10:*:*:*:*:*:*", "matchCriteriaId": "2DAB0402-9690-4243-8B8C-2F172AAE2C0F", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u11:*:*:*:*:*:*", "matchCriteriaId": "B86C6A7C-7140-487B-821B-A43417CC7563", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u12:*:*:*:*:*:*", "matchCriteriaId": "E83089CD-C7A6-4A38-9D66-1BD9CBA924DC", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u13:*:*:*:*:*:*", "matchCriteriaId": "5B28B443-BC75-4242-8507-BECF19643494", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u14:*:*:*:*:*:*", "matchCriteriaId": "DD7C0B63-A98D-4DE3-A6CC-450B2B5E24BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u15:*:*:*:*:*:*", "matchCriteriaId": "5EF7DFAD-C645-4C17-BD8B-6AE48A320638", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u16:*:*:*:*:*:*", "matchCriteriaId": "7F52979B-FFAF-46BD-A8D9-E2577A9EC348", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u17:*:*:*:*:*:*", "matchCriteriaId": "90CFE193-D935-44B3-935D-0DCF6946152C", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u18:*:*:*:*:*:*", "matchCriteriaId": "A1DD6725-9556-45A2-8B06-58C810009197", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u19:*:*:*:*:*:*", "matchCriteriaId": "3E0B9523-E67D-4186-8896-030F69B41C4C", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u2:*:*:*:*:*:*", "matchCriteriaId": "21F18E6E-BB26-46E9-8D27-8B697E922251", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u3:*:*:*:*:*:*", "matchCriteriaId": "310BE409-1D0E-46FC-B844-C19E1121499C", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u4:*:*:*:*:*:*", "matchCriteriaId": "E3A7E805-AFD2-4B59-8DD5-C0EEFA3A6CA9", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u5:*:*:*:*:*:*", "matchCriteriaId": "02FBEF38-47CC-4BAA-8AC6-E320C39D58EC", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u6:*:*:*:*:*:*", "matchCriteriaId": "0DCA6B2A-2E8C-4E54-B5D5-F4D25B5A1D5C", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u7:*:*:*:*:*:*", "matchCriteriaId": "0DE942D5-93D4-4081-B670-CEE98B9B043C", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u8:*:*:*:*:*:*", "matchCriteriaId": "87A3CE1B-7B61-42B9-A670-90C75CF02A92", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:10.0:u9:*:*:*:*:*:*", "matchCriteriaId": "82E894D8-4B43-493D-89C3-315541403598", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:11.0:-:*:*:*:*:*:*", "matchCriteriaId": "BFDDD30A-3F6D-4611-A7EC-D66BC481D59D", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:11.0:u1:*:*:*:*:*:*", "matchCriteriaId": "08DA209E-A8FC-4917-9FC5-2DFB93339F92", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:11.0:u2:*:*:*:*:*:*", "matchCriteriaId": "3786FB40-4B9C-4934-8B2D-8EA6E0D93E31", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:11.0:u3:*:*:*:*:*:*", "matchCriteriaId": "56AA6016-4EA4-44B9-995A-323B67C8BC18", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:11.0:u4:*:*:*:*:*:*", "matchCriteriaId": "21325FFE-6BE6-463D-A166-E97E33C2B38B", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:11.0:u5:*:*:*:*:*:*", "matchCriteriaId": "FD179AD2-8B30-4B99-9580-53FE28930934", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:11.0:u6:*:*:*:*:*:*", "matchCriteriaId": "F86DCE2E-1494-4A62-BD87-2847DF3BC84E", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:11.0:u7:*:*:*:*:*:*", "matchCriteriaId": "593485A9-57B2-4F9C-8E07-51F8834C5A25", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:deep_security_manager:11.3:-:*:*:*:*:*:*", "matchCriteriaId": "23E02397-40A2-4184-9E4C-8B38CF91EC16", "vulnerable": true}, {"criteria": "cpe:2.3:a:trendmicro:vulnerability_protection:2.0:-:*:*:*:*:*:*", "matchCriteriaId": "1749CC8D-55E1-4278-BF9C-F0B415C32F31", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM)."}, {"lang": "es", "value": "Trend Micro Deep Security Manager (versiones 10.x, 11.x) y Vulnerability Protection (versi\u00f3n 2.0) son vulnerables a un ataque de tipo XML External Entity. Sin embargo, para que el ataque sea posible, el atacante debe tener acceso root/admin a un host protegido que est\u00e9 autorizado para comunicarse con el Deep Security Manager (DSM)."}], "id": "CVE-2019-9488", "lastModified": "2024-11-21T04:51:42.967", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-09-11T18:15:10.817", "references": [{"source": "security@trendmicro.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://success.trendmicro.com/solution/1122900"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://success.trendmicro.com/solution/1122900"}], "sourceIdentifier": "security@trendmicro.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-611"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:-:*:*:*:*:*:* (string)

matchCriteriaId : 591F99B9-037F-49F2-90C9-C9327465ED3C (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u1:*:*:*:*:*:* (string)

matchCriteriaId : EF1D72E4-FDF6-42F2-9386-61EC30C1D211 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u10:*:*:*:*:*:* (string)

matchCriteriaId : 2DAB0402-9690-4243-8B8C-2F172AAE2C0F (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u11:*:*:*:*:*:* (string)

matchCriteriaId : B86C6A7C-7140-487B-821B-A43417CC7563 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u12:*:*:*:*:*:* (string)

matchCriteriaId : E83089CD-C7A6-4A38-9D66-1BD9CBA924DC (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u13:*:*:*:*:*:* (string)

matchCriteriaId : 5B28B443-BC75-4242-8507-BECF19643494 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u14:*:*:*:*:*:* (string)

matchCriteriaId : DD7C0B63-A98D-4DE3-A6CC-450B2B5E24BB (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u15:*:*:*:*:*:* (string)

matchCriteriaId : 5EF7DFAD-C645-4C17-BD8B-6AE48A320638 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u16:*:*:*:*:*:* (string)

matchCriteriaId : 7F52979B-FFAF-46BD-A8D9-E2577A9EC348 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u17:*:*:*:*:*:* (string)

matchCriteriaId : 90CFE193-D935-44B3-935D-0DCF6946152C (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u18:*:*:*:*:*:* (string)

matchCriteriaId : A1DD6725-9556-45A2-8B06-58C810009197 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u19:*:*:*:*:*:* (string)

matchCriteriaId : 3E0B9523-E67D-4186-8896-030F69B41C4C (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u2:*:*:*:*:*:* (string)

matchCriteriaId : 21F18E6E-BB26-46E9-8D27-8B697E922251 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u3:*:*:*:*:*:* (string)

matchCriteriaId : 310BE409-1D0E-46FC-B844-C19E1121499C (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u4:*:*:*:*:*:* (string)

matchCriteriaId : E3A7E805-AFD2-4B59-8DD5-C0EEFA3A6CA9 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u5:*:*:*:*:*:* (string)

matchCriteriaId : 02FBEF38-47CC-4BAA-8AC6-E320C39D58EC (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u6:*:*:*:*:*:* (string)

matchCriteriaId : 0DCA6B2A-2E8C-4E54-B5D5-F4D25B5A1D5C (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u7:*:*:*:*:*:* (string)

matchCriteriaId : 0DE942D5-93D4-4081-B670-CEE98B9B043C (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u8:*:*:*:*:*:* (string)

matchCriteriaId : 87A3CE1B-7B61-42B9-A670-90C75CF02A92 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:10.0:u9:*:*:*:*:*:* (string)

matchCriteriaId : 82E894D8-4B43-493D-89C3-315541403598 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:11.0:-:*:*:*:*:*:* (string)

matchCriteriaId : BFDDD30A-3F6D-4611-A7EC-D66BC481D59D (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:11.0:u1:*:*:*:*:*:* (string)

matchCriteriaId : 08DA209E-A8FC-4917-9FC5-2DFB93339F92 (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:11.0:u2:*:*:*:*:*:* (string)

matchCriteriaId : 3786FB40-4B9C-4934-8B2D-8EA6E0D93E31 (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:11.0:u3:*:*:*:*:*:* (string)

matchCriteriaId : 56AA6016-4EA4-44B9-995A-323B67C8BC18 (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:11.0:u4:*:*:*:*:*:* (string)

matchCriteriaId : 21325FFE-6BE6-463D-A166-E97E33C2B38B (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:11.0:u5:*:*:*:*:*:* (string)

matchCriteriaId : FD179AD2-8B30-4B99-9580-53FE28930934 (string)

vulnerable : true (boolean)

}

26 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:11.0:u6:*:*:*:*:*:* (string)

matchCriteriaId : F86DCE2E-1494-4A62-BD87-2847DF3BC84E (string)

vulnerable : true (boolean)

}

27 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:11.0:u7:*:*:*:*:*:* (string)

matchCriteriaId : 593485A9-57B2-4F9C-8E07-51F8834C5A25 (string)

vulnerable : true (boolean)

}

28 : { »

criteria : cpe:2.3:a:trendmicro:deep_security_manager:11.3:-:*:*:*:*:*:* (string)

matchCriteriaId : 23E02397-40A2-4184-9E4C-8B38CF91EC16 (string)

vulnerable : true (boolean)

}

29 : { »

criteria : cpe:2.3:a:trendmicro:vulnerability_protection:2.0:-:*:*:*:*:*:* (string)

matchCriteriaId : 1749CC8D-55E1-4278-BF9C-F0B415C32F31 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM). (string)

}

1 : { »

lang : es (string)

value : Trend Micro Deep Security Manager (versiones 10.x, 11.x) y Vulnerability Protection (versión 2.0) son vulnerables a un ataque de tipo XML External Entity. Sin embargo, para que el ataque sea posible, el atacante debe tener acceso root/admin a un host protegido que esté autorizado para comunicarse con el Deep Security Manager (DSM). (string)

}

]

id : CVE-2019-9488 (string)

lastModified : 2024-11-21T04:51:42.967 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : NONE (string)

baseScore : 4 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:S/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 8 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2019-09-11T18:15:10.817 (string)

references : [ »

0 : { »

source : security@trendmicro.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://success.trendmicro.com/solution/1122900 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://success.trendmicro.com/solution/1122900 (string)

}

]

sourceIdentifier : security@trendmicro.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-611 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object