5.5

CVE-2015-2873

Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct request to the (1) system log URL, (2) whitelist URL, or (3) blacklist URL.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Trendmicro ≫ Deep Discovery Inspector Version3.5 Langja
Trendmicro ≫ Deep Discovery Inspector Version3.5 Langzh
Trendmicro ≫ Deep Discovery Inspector Version3.7 Langja
Trendmicro ≫ Deep Discovery Inspector Version3.7 Langzh
Trendmicro ≫ Deep Discovery Inspector Version3.8 Langja
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.98% 0.86
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
CWE-425 Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

http://www.kb.cert.org/vuls/id/248692
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/76396
Third Party Advisory
VDB Entry