CVE-2019-18187

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 25,1%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada trendmicro officescan. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.

Rincian

Terbit di NVD

28 Oktober 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

25,1% peluang dieksploitasi; lebih tinggi dari 97,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Trend Micro OfficeScan Directory Traversal Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://success.trendmicro.com/solution/000151730 broken link · advisory vendor
• https://web.archive.org/web/20200215171235/https://success.trendmicro.com/solution/000151730 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18187 pemerintah AS