PT-2018-9841 · Trend Micro · Trend Micro Email Encryption Gateway

Steven Seeley · Published 2018-05-04 · Updated 2019-10-03 · CVE-2018-10355

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Trend Micro Email Encryption Gateway version 5.5

Description: The issue is related to an authentication weakness due to a flaw in the DBCrypto class, which could allow an attacker to recover user passwords if they first obtain access to the user database on the target system.

Recommendations: For Trend Micro Email Encryption Gateway version 5.5, consider restricting access to the user database to minimize the risk of exploitation, and apply any available patches or updates from the vendor to fix the flaw in the DBCrypto class.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-10355

ZDI-18-411

Affected Products

Trend Micro Email Encryption Gateway

References · 4

• https://zerodayinitiative.com/advisories/ZDI-18-411 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-10355 · Security Note
• https://success.trendmicro.com/solution/1119349 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10355 · Vendor Advisory