CVE-2019-9488 Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/ad...
MediumCVSS 4.9
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trendmicro deep security manager | = 10.0 | No fix listed |
| trendmicro deep security manager | = 10.0-u1 | No fix listed |
| trendmicro deep security manager | = 10.0-u10 | No fix listed |
| trendmicro deep security manager | = 10.0-u11 | No fix listed |
| trendmicro deep security manager | = 10.0-u12 | No fix listed |
| trendmicro deep security manager | = 10.0-u13 | No fix listed |
| trendmicro deep security manager | = 10.0-u14 | No fix listed |
| trendmicro deep security manager | = 10.0-u15 | No fix listed |
| trendmicro deep security manager | = 10.0-u16 | No fix listed |
| trendmicro deep security manager | = 10.0-u17 | No fix listed |
| trendmicro deep security manager | = 10.0-u18 | No fix listed |
| trendmicro deep security manager | = 10.0-u19 | No fix listed |
| trendmicro deep security manager | = 10.0-u2 | No fix listed |
| trendmicro deep security manager | = 10.0-u3 | No fix listed |
| trendmicro deep security manager | = 10.0-u4 | No fix listed |
| trendmicro deep security manager | = 10.0-u5 | No fix listed |
| trendmicro deep security manager | = 10.0-u6 | No fix listed |
| trendmicro deep security manager | = 10.0-u7 | No fix listed |
| trendmicro deep security manager | = 10.0-u8 | No fix listed |
| trendmicro deep security manager | = 10.0-u9 | No fix listed |
| trendmicro deep security manager | = 11.0 | No fix listed |
| trendmicro deep security manager | = 11.0-u1 | No fix listed |
| trendmicro deep security manager | = 11.0-u2 | No fix listed |
| trendmicro deep security manager | = 11.0-u3 | No fix listed |
| trendmicro deep security manager | = 11.0-u4 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| trendmicro deep security manager | = 11.0-u5 | No fix listed |
| trendmicro deep security manager | = 11.0-u6 | No fix listed |
| trendmicro deep security manager | = 11.0-u7 | No fix listed |
| trendmicro deep security manager | = 11.3 | No fix listed |
| trendmicro vulnerability protection | = 2.0 | No fix listed |
| Trend Micro Deep Security | = 10.x | No fix listed |
| Trend Micro Deep Security | = 11.x | No fix listed |
| Trend Micro Vulnerability Protection | = 2.0 | No fix listed |
References
- success.trendmicro.com patch vendor-advisory