PT-2016-5898 · Trend Micro · Trend Micro Email Encryption Gateway

Published 2016-04-28 · Updated 2021-09-09 · CVE-2016-4351

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Email Encryption Gateway versions prior to 5.5 build 1107

Description The issue concerns a SQL injection vulnerability in the authentication functionality. This allows remote attackers to execute arbitrary SQL commands.

Recommendations For versions prior to 5.5 build 1107, update to build 1107 or later to resolve the issue.

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-4351

ZDI-16-248

Affected Products

Trend Micro Email Encryption Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-4351 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-248 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4351 · Vendor Advisory
• https://esupport.trendmicro.com/solution/en-US/1114060.aspx · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-16-248 · Note