VulnerabilityModified
CVE-2018-6220
An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to gaining code execution on vulnerable systems.
CRITICAL 9.8EPSS 9.85%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (9.85%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An arbitrary file write vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to inject arbitrary data, which may lead to gaining code execution on vulnerable systems.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 9.85% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- trendmicro/email encryption gateway
- Source
- security@trendmicro.com
References
- https://success.trendmicro.com/solution/1119349Patch, Vendor Advisory
- https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilitiesExploit, Technical Description, Third Party Advisory
- https://www.exploit-db.com/exploits/44166/Exploit, Third Party Advisory, VDB Entry
- https://success.trendmicro.com/solution/1119349Patch, Vendor Advisory
- https://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilitiesExploit, Technical Description, Third Party Advisory
- https://www.exploit-db.com/exploits/44166/Exploit, Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.