VulnerabilityModified
CVE-2020-27017
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files.
MEDIUM 4.9EPSS 6.47%
Does this matter?
Lower severity and a low EPSS score (6.47%). Track it; it rarely justifies an emergency change on its own.
Description
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.
- CVSS 3.1
- 4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 6.47% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-611
- Affected
- trendmicro/interscan messaging security virtual appliance
- Source
- security@trendmicro.com
References
- https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/Exploit, Third Party Advisory
- https://success.trendmicro.com/solution/000279833Exploit, Vendor Advisory
- https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/Exploit, Third Party Advisory
- https://success.trendmicro.com/solution/000279833Exploit, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.