PT-2020-14525 · Trend Micro · Trend Micro Deep Security

Partick Hussey · Published 2020-08-21 · Updated 2020-09-03 · CVE-2020-15601

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Deep Security versions 10.x through 12.x

Description The issue allows an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager authentication if LDAP authentication is enabled. Enabling multi-factor authentication can prevent this attack. Installations using manager native authentication or SAML authentication are not impacted.

Recommendations For Trend Micro Deep Security versions 10.x through 12.x, enable multi-factor authentication to prevent the authentication bypass attack.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2020-04359

CVE-2020-15601

ZDI-20-1077

Affected Products

Trend Micro Deep Security

References · 6

• https://osv.dev/vulnerability/CVE-2020-15601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15601 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-1077 · Security Note
• https://success.trendmicro.com/solution/000252039 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04359 · Security Note
• https://cxsecurity.com/cveshow/CVE-2020-15601 · Note