{"schemaVersion":3,"id":"CVE-2020-27017","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.","dates":{"published":"2020-11-09T23:10:34.000Z","modified":"2024-08-04T16:03:23.261Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.9,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.06469,"percentile":0.93681,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.06469},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.06469,"percentile":0.93681}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.06469,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.06469,"percentile":0.93681}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_78F8FDCFD9CCCC67","name":"Exploit Reference (success.trendmicro.com)","source":"reference","url":"https://success.trendmicro.com/solution/000279833","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"REF_814E8305951AAB29","name":"Exploit Reference (sec-consult.com)","source":"reference","url":"https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":2,"weaknesses":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference","description":"The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/611.html"}],"affected":[{"vendor":"trend micro","product":"trend micro interscan messaging security virtual appliance (imsva)","name":"Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA)","label":"trend micro interscan messaging security virtual appliance (imsva)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"9.1","eol":null,"hubHref":"/vendor/trend_micro/trend_micro_interscan_messaging_security_virtual_appliance_imsva"},{"vendor":"trendmicro","product":"interscan_messaging_security_virtual_appliance","name":"interscan messaging security virtual appliance","label":"interscan_messaging_security_virtual_appliance","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 9.1","eol":null,"hubHref":"/vendor/trendmicro/interscan_messaging_security_virtual_appliance"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://success.trendmicro.com/solution/000279833","label":"success.trendmicro.com/solution/000279833","hostname":"success.trendmicro.com","tags":["X Refsource MISC","Exploit","Vendor Advisory"]},{"url":"https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/","label":"sec-consult.com/en/…","hostname":"sec-consult.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-11-09T23:10:34.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T16:03:23.261Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T22:18:54.191Z","stale":false,"partial":false}}