Actively exploited · Published Oct 28, 2019 · Assigned by trendmicro
CVE-2019-18187
High 8.8 Exploited
In plain English
A high-severity path traversal in Trend Micro OfficeScan from Trend Micro. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 25.1% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Trend Micro | Trend Micro OfficeScan | Version 11.0, XG (12.0) |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H