CVE-2015-2873: trendmicro deep_discovery_inspector Forced Browsing

Vulnerability summary

CVE-2015-2873 is a medium (CVSS 5.5) Forced Browsing vulnerability in trendmicro deep_discovery_inspector. EPSS estimates a 2.67% chance of exploitation in the next 30 days, higher than 85.5% of scored vulnerabilities.

Timeline

1. 23-08-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allows remote attackers to obtain sensitive information or change the configuration via a direct request to the (1) system log URL, (2) whitelist URL, or (3) blacklist URL.

• CWE-425Direct Request ('Forced Browsing')The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.