JVNVU#99059651
Multiple Trend Micro products vulnerable to XML external entity injection (XXE)
Overview
Multiple Trend Micro products contain an XML external entity injection (XXE) vulnerability.
Products Affected
- Trend Micro Deep Security Manager versions prior to 12.0
- Trend Micro Vulnerability Protection Manager 2.0 SP2 Patch7 and earlier
Description
Trend Micro Deep Security and Trend Micro Vulnerability Protection provided by Trend Micro contain an XML external entity injection (XXE) vulnerability (CWE-611).
Impact
An attacker may conduct an XXE attack with the administrative privilege of an Deep Security Agent installed host which the agent is managed by Trend Micro Deep Security Manager or Trend Micro Vulnerability Protection Manager.
Solution
Update the software or apply the patch
Update to the latest version or apply the appropriate patch according to the information provided by the developer.
Vendor Status
| Vendor | Link |
| Trend Micro Incorporated | SECURITY BULLETIN: Trend Micro Deep Security and Vulnerability Protection XXE Vulnerability |
References
JPCERT/CC Addendum
Vulnerability Analysis by JPCERT/CC
| Attack Vector(AV) | Physical (P) | Local (L) | Adjacent (A) | Network (N) |
|---|---|---|---|---|
| Attack Complexity(AC) | High (H) | Low (L) | ||
| Privileges Required(PR) | High (H) | Low (L) | None (N) | |
| User Interaction(UI) | Required (R) | None (N) | ||
| Scope(S) | Unchanged (U) | Changed (C) | ||
| Confidentiality Impact(C) | None (N) | Low (L) | High (H) | |
| Integrity Impact(I) | None (N) | Low (L) | High (H) | |
| Availability Impact(A) | None (N) | Low (L) | High (H) |
| Access Vector(AV) | Local (L) | Adjacent Network (A) | Network (N) |
|---|---|---|---|
| Access Complexity(AC) | High (H) | Medium (M) | Low (L) |
| Authentication(Au) | Multiple (M) | Single (S) | None (N) |
| Confidentiality Impact(C) | None (N) | Partial (P) | Complete (C) |
| Integrity Impact(I) | None (N) | Partial (P) | Complete (C) |
| Availability Impact(A) | None (N) | Partial (P) | Complete (C) |
Credit
The developer reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and the developer coordinated under the Information Security Early Warning Partnership.
Other Information
| JPCERT Alert |
|
| JPCERT Reports |
|
| CERT Advisory |
|
| CPNI Advisory |
|
| TRnotes |
|
| CVE |
CVE-2019-9488 |
| JVN iPedia |
|