CVE-2018-3609: trend micro trend micro interscan messaging security virtual appliance Insufficiently Protected Credentials
Vulnerability summary
CVE-2018-3609 is a high (CVSS 8.1) Insufficiently Protected Credentials vulnerability in trend micro trend micro interscan messaging security virtual appliance. EPSS estimates a 21.45% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 16-02-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
21.45%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 21.45% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (korelogic.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
Affected systems
Trend micro1 product
Trendmicro1 product
2 vendors · 2 products