PT-2014-8573 · Trend Micro · Trend Micro Interscan Web Security Virtual Appliance

Brandon Perry · Publicado 2014-11-06 · Atualizado 2014-11-10 · CVE-2014-8510

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance versions prior to 6.0 HF build 1244

Description The issue allows remote authenticated users to read arbitrary files via vectors related to configuration input when saving filters. This is related to the AdminUI in the affected software.

Recommendations For versions prior to 6.0 HF build 1244, update to 6.0 HF build 1244 or later to resolve the issue. As a temporary workaround, consider restricting access to the AdminUI to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-8510

ZDI-14-373

Produtos afetados

Trend Micro Interscan Web Security Virtual Appliance

Referências · 4

• https://zerodayinitiative.com/advisories/ZDI-14-373 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8510 · Nota
• http://zerodayinitiative.com/advisories/ZDI-14-373 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8510 · Nota de Segurança