PT-2021-19402 · Trend Micro · Trend Micro Security

Quentin Kaiser · Published 2021-05-07 · Updated 2021-05-19 · CVE-2021-31520

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro IM Security versions 1.6 through 1.6.5

Description A weak session token authentication bypass issue could allow a remote attacker to guess the session token of currently logged-in administrators, potentially gaining access to the product's web management interface.

Recommendations For versions 1.6 through 1.6.5, consider restricting access to the web management interface until a fix is available. As a temporary workaround, limit the ability for remote attackers to guess session tokens by implementing additional security measures, such as IP restrictions or rate limiting, on the web management interface. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-31520

ZDI-21-525

Affected Products

Trend Micro Security

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-31520 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-21-525 · Security Note
• https://success.trendmicro.com/solution/000286439 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31520 · Vendor Advisory