PT-2022-21779 · Trellix · Trellix Ips Manager

Published 2022-11-04 · Updated 2022-11-08 · CVE-2022-3340

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trellix IPS Manager versions prior to 10.1 M8

Description The issue allows a remote authenticated administrator to perform an XML External Entity (XXE) attack in the administrator interface. This is done by importing a saved XML configuration file, enabling the attacker to exploit the vulnerability.

Recommendations For versions prior to 10.1 M8, update to version 10.1 M8 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrator interface and limiting the ability to import XML configuration files until a patch is applied.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2022-3340

Affected Products

Trellix Ips Manager

References · 5

• https://kcm.trellix.com/corporate/index?page=content&id=SB10388 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3340 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3340 · Vendor Advisory
• https://t.me/cvenotify/37285 · Telegram Post
• https://t.me/cibsecurity/52552 · Telegram Post