Content Validation Escape Vulnerability in Trend Micro Products
CVE-2020-8468

8.8HIGH

Key Information:

Vendor
Trend Micro
Status
Trend Micro Officescan, Trend Micro Apex One, Trend Micro Worry-free Business Security (wfbs)
Vendor
CVE Published:
18 March 2020

Badges

👾 Exploit Exists🦅 CISA Reported

Summary

Trend Micro Apex One (2019), OfficeScan XG, and Worry-Free Business Security (versions 9.0, 9.5, and 10.0) are susceptible to a content validation escape vulnerability. This flaw could allow an authenticated attacker to manipulate specific components within the agent client, leading to potential unauthorized actions or data exposure. Organizations utilizing these products should ensure that they maintain up-to-date security measures to mitigate risks associated with this vulnerability.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Trend Micro OfficeScan, Trend Micro Apex One, Trend Micro Worry-Free Business Security (WFBS) OfficeScan XG (12.0), Apex One 2019 (14.0), WFBS 9.0, 9.5 and 10.0

References

https://success.trendmicro.com/solution/000245571
x_refsource_MISC
https://success.trendmicro.com/jp/solution/000244253
x_refsource_MISC
https://success.trendmicro.com/solution/000245572
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.