CVE-2021-25236

EPSS 0.42%
Published 04.02.2021 20:15:13
Last modified 21.11.2024 05:54:36
Source security@trendmicro.com
Teams watchlist Login
Open Login

A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro OfficeScan XG SP1 and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a specific sweep.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Trendmicro ≫ Officescan Versionxg Updatesp1

Microsoft ≫ Windows Version-

Trendmicro ≫ Worry-free Business Security Version10.0 Updatesp1

Microsoft ≫ Windows Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.42%	0.59

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://success.trendmicro.com/solution/000284205

Patch

Vendor Advisory

https://success.trendmicro.com/solution/000284206

Patch

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-120/

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2021-25236

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-25236

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-25236

EUVD