CVE-2021-25236

EPSS 0.42%
Veröffentlicht 04.02.2021 20:15:13
Zuletzt bearbeitet 21.11.2024 05:54:36
Quelle security@trendmicro.com
Teams Watchlist Login
Unerledigt Login

A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a specific sweep.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Trendmicro ≫ Officescan Versionxg Updatesp1

Microsoft ≫ Windows Version-

Trendmicro ≫ Worry-free Business Security Version10.0 Updatesp1

Microsoft ≫ Windows Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.42%	0.59

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://success.trendmicro.com/solution/000284205

Patch

Vendor Advisory

https://success.trendmicro.com/solution/000284206

Patch

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-120/

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2021-25236

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-25236

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-25236

EUVD