CVE-2020-15605 — Improper Authentication in Micro Vulnerability Protection

CWE-287 — Improper AuthenticationCWE-444 — HTTP Request Smuggling4 documents4 sources
Severity
8.1HIGHNVD
EPSS
3.8%
top 11.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Trend Micro Vulnerability ProtectionTrendmicro Deep Security ManagerTrendmicro Vulnerability Protection
Timeline
PublishedAug 27
Latest updateMay 18

Description

If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2.0 SP2 could allow an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager authentication. Enabling multi-factor authentication prevents this attack. Installations using manager native authentication or SAML authentication are not impacted by this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages3 packages

▶NVDtrendmicro/deep_security_manager10.0, 11.0, 12.0+2

Patches

Patch: success.trendmicro.com ↗Patch: success.trendmicro.com ↗

🔴Vulnerability Details

3
GHSA
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header↗2023-05-18
▶
GHSA
GHSA-xfgp-29qh-w6p6: If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2↗2022-05-24
▶
CVEList
CVE-2020-15605: If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2↗2020-08-27
▶
CVE-2020-15605 — Improper Authentication in Trend | cvebase