CVE-2020-27017: trend micro trend micro interscan messaging security virtual appliance (imsva)

Vulnerability summary

CVE-2020-27017 is a medium (CVSS 4.9) vulnerability in trend micro trend micro interscan messaging security virtual appliance (imsva). EPSS estimates a 6.47% chance of exploitation in the next 30 days, higher than 93.6% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 09-11-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.

• CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.