PT-2015-5954 · Trend Micro · Trend Micro Deep Discovery Inspector

Hyp3Rlinx + 1 · Publicado 2015-08-23 · Atualizado 2021-09-09 · CVE-2015-2873

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Deep Discovery Inspector (DDI) versions prior to 3.5.1477 Trend Micro Deep Discovery Inspector (DDI) versions 3.6.x prior to 3.6.1217 Trend Micro Deep Discovery Inspector (DDI) versions 3.7.x prior to 3.7.1248 Trend Micro Deep Discovery Inspector (DDI) versions 3.8.x prior to 3.8.1263

Description The issue allows remote attackers to obtain sensitive information or change the configuration via a direct request to specific URLs, including the system log URL, whitelist URL, or blacklist URL.

Recommendations For versions prior to 3.5.1477, update to version 3.5.1477 or later. For versions 3.6.x prior to 3.6.1217, update to version 3.6.1217 or later. For versions 3.7.x prior to 3.7.1248, update to version 3.7.1248 or later. For versions 3.8.x prior to 3.8.1263, update to version 3.8.1263 or later.

Correção

Enumeração de Fraquezas

CWE-425

Identificadores relacionados

CVE-2015-2873

Produtos afetados

Trend Micro Deep Discovery Inspector

Referências · 5

• http://esupport.trendmicro.com/solution/en-US/1112206.aspx · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2873 · Nota de Segurança
• http://securityfocus.com/bid/76396 · Nota
• http://kb.cert.org/vuls/id/248692 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2873 · Nota