PT-2018-9841 · Trend Micro · Trend Micro Email Encryption Gateway

Steven Seeley · Publicado 2018-05-04 · Atualizado 2019-10-03 · CVE-2018-10355

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Trend Micro Email Encryption Gateway version 5.5

Description: The issue is related to an authentication weakness due to a flaw in the DBCrypto class, which could allow an attacker to recover user passwords if they first obtain access to the user database on the target system.

Recommendations: For Trend Micro Email Encryption Gateway version 5.5, consider restricting access to the user database to minimize the risk of exploitation, and apply any available patches or updates from the vendor to fix the flaw in the DBCrypto class.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-10355

ZDI-18-411

Produtos afetados

Trend Micro Email Encryption Gateway

Referências · 4

• https://zerodayinitiative.com/advisories/ZDI-18-411 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-10355 · Nota de Segurança
• https://success.trendmicro.com/solution/1119349 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-10355 · Aviso do Fabricante