CVE-2021-25241

EPSS 0.42%
Published 04.02.2021 20:15:14
Last modified 21.11.2024 05:54:36
Source security@trendmicro.com
Teams watchlist Login
Open Login

A server-side request forgery (SSRF) information disclosure vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 could allow an unauthenticated user to locate online agents via a sweep.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Trendmicro ≫ Apex One Version2019

Microsoft ≫ Windows Version-

Trendmicro ≫ Worry-free Business Security Version10.0 Updatesp1

Microsoft ≫ Windows Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.42%	0.59

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://success.trendmicro.com/solution/000284202

Patch

Vendor Advisory

https://success.trendmicro.com/solution/000284206

Patch

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-21-114/

Third Party Advisory

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2021-25241

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2021-25241

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2021-25241

EUVD