SQL Injection Vulnerability in Trend Micro Email Encryption Gateway
CVE-2018-6230

6.8MEDIUM

Key Information:

Vendor

Trend Micro
Status
Trend Micro Email Encryption Gateway
Vendor
CVE Published:
15 March 2018

What is CVE-2018-6230?

A SQL injection vulnerability exists in the search configuration script of Trend Micro Email Encryption Gateway 5.5. This security flaw allows an attacker to craft malicious SQL commands that may be executed on the database, potentially enabling the upload and execution of arbitrary code. Such exploitation can compromise the integrity and functionality of the target system, posing significant risks to data security and availability.

Affected Version(s)

Trend Micro Email Encryption Gateway 5.5

References

https://www.exploit-db.com/exploits/44166/
exploitx_refsource_EXPLOIT-DB
https://success.trendmicro.com/solution/1119349
x_refsource_CONFIRM
https://www.coresecurity.com/advisories/trend-micro-email...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.