CVE-2020-8600
Trend Micro Worry-Free Business Security Directory Traversal Authentication Bypass Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Trend Micro Worry-Free Business Security (9.0, 9.5, 10.0) is affected by a directory traversal vulnerability that could allow an attacker to manipulate a key file to bypass authentication.
Trend Micro Worry-Free Business Security versiones (9.0, 9.5, 10.0), está afectado por una vulnerabilidad de salto del directorio que podría permitir a un atacante manipular un archivo de clave para omitir una autenticación.
This vulnerability allows remote attackers to bypass authentication on affected installations of Trend Micro Worry-Free Business Security. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the TempFileName parameter provided to the cgiRecvFile.exe endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to bypass authentication on the system.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-02-04 CVE Reserved
- 2020-03-17 CVE Published
- 2024-03-11 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-20-307 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://success.trendmicro.com/jp/solution/000244836 | 2020-03-20 | |
| https://success.trendmicro.com/solution/000245572 | 2020-03-20 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Trendmicro Search vendor "Trendmicro" | Worry-free Business Security Search vendor "Trendmicro" for product "Worry-free Business Security" | 9.0 Search vendor "Trendmicro" for product "Worry-free Business Security" and version "9.0" | sp3 |
Affected
| ||||||
| Trendmicro Search vendor "Trendmicro" | Worry-free Business Security Search vendor "Trendmicro" for product "Worry-free Business Security" | 9.5 Search vendor "Trendmicro" for product "Worry-free Business Security" and version "9.5" | - |
Affected
| ||||||
| Trendmicro Search vendor "Trendmicro" | Worry-free Business Security Search vendor "Trendmicro" for product "Worry-free Business Security" | 10.0 Search vendor "Trendmicro" for product "Worry-free Business Security" and version "10.0" | - |
Affected
| ||||||
| Trendmicro Search vendor "Trendmicro" | Worry-free Business Security Search vendor "Trendmicro" for product "Worry-free Business Security" | 10.0 Search vendor "Trendmicro" for product "Worry-free Business Security" and version "10.0" | sp1 |
Affected
| ||||||