CVE-2020-27017 — XML External Entity (XXE) Injection in Interscan Messaging Security Virtual Appliance

CWE-611 — XML External Entity (XXE) InjectionCWE-776 — XML Entity Expansion3 documents3 sources
Severity
4.9MEDIUMNVD
EPSS
1.0%
top 22.99%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Trendmicro Interscan Messaging Security Virtual ApplianceTrend Micro Interscan Messaging Security Virtual Appliance
Timeline
PublishedNov 9
Latest updateMay 24

Description

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-m5fq-fj2f-7888: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9↗2022-05-24
▶
CVEList
CVE-2020-27017: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9↗2020-11-09
▶
CVE-2020-27017 — XML External Entity (XXE) Injection | cvebase