PT-2020-20152 · Trend Micro · Trend Micro Interscan Web Security Virtual Appliance

Wolfgang Ettlinger · Published 2020-12-17 · Updated 2020-12-22 · CVE-2020-8464

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2

Description A vulnerability could allow an attacker to send requests that appear to come from the localhost, potentially exposing the product's admin interface to users who would not normally have access.

Recommendations For Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2, consider restricting access to the admin interface as a temporary workaround until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-8464

Affected Products

Trend Micro Interscan Web Security Virtual Appliance

References · 9

• 🔥 https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance · Exploit
• https://osv.dev/vulnerability/CVE-2020-8464 · Vendor Advisory
• https://success.trendmicro.com/solution/000283077 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8464 · Security Note
• https://t.me/cybersecuritytechnologies/2317 · Telegram Post
• https://t.me/cvenotify/7269 · Telegram Post
• https://t.me/cvenotify/7273 · Telegram Post
• https://t.me/cibsecurity/21020 · Telegram Post
• https://t.me/cibsecurity/21019 · Telegram Post