CVE-2018-3609 — Insufficiently Protected Credentials in Micro Interscan Messaging Security Virtual Appliance

CWE-522 — Insufficiently Protected CredentialsCWE-532 — Log File Information Exposure3 documents3 sources
Severity
8.1HIGHNVD
EPSS
16.3%
top 5.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Trend Micro Interscan Messaging Security Virtual ApplianceTrendmicro Interscan Messaging Security Virtual Appliance
Timeline
PublishedFeb 16
Latest updateMay 13

Description

A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-999p-3hf6-2qgp: A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9↗2022-05-13
▶
CVEList
CVE-2018-3609: A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9↗2018-02-16
▶
CVE-2018-3609 — Insufficiently Protected Credentials | cvebase