Authentication Bypass in Trend Micro ServerProtect Information Server
CVE-2022-25329
9.8CRITICAL
Key Information:
Summary
Trend Micro ServerProtect versions 6.0 and 5.8 contain a vulnerability that allows unauthenticated remote attackers to exploit the Information Server. By using a specific command in the console, an attacker could register on the server and execute actions as an authenticated user. This flaw stems from the use of static credentials during the authentication process, posing a significant security risk for organizations relying on these versions.
Affected Version(s)
Trend Micro ServerProtect for EMC Celerra 5.8
Trend Micro ServerProtect for Microsoft Windows / Novell NetWare 5.8
Trend Micro ServerProtect for Network Appliance Filers 5.8
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved