CVE-2020-27018 — Server-Side Request Forgery in Interscan Messaging Security Virtual Appliance

CWE-918 — Server-Side Request Forgery3 documents3 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 66.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Trendmicro Interscan Messaging Security Virtual ApplianceTrend Micro Interscan Messaging Security Virtual Appliance
Timeline
PublishedNov 9
Latest updateMay 24

Description

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a server side request forgery vulnerability which could allow an authenticated attacker to abuse the product's web server and grant access to web resources or parts of local files. An attacker must already have obtained authenticated privileges on the product to exploit this vulnerability.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-h8rc-vwv6-26wf: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9↗2022-05-24
▶
CVEList
CVE-2020-27018: Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9↗2020-11-09
▶
CVE-2020-27018 — Server-Side Request Forgery | cvebase