CVE-2020-8466
critical · 9.8A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password.
9.8
CVSS
64.1%
EPSS (exploit prob.)
99th
EPSS percentile
2020-12-17
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| trendmicro | interscan_web_security_virtual_appliance | 6.5 |
Check a specific version with /api/v1/cve/match.
References
- https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/
- https://success.trendmicro.com/solution/000283077
- https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/
- https://success.trendmicro.com/solution/000283077
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2020-8466