CVE-2018-3600: Trend Micro Control Manager AdHocQuery_Processor External Entity Processing Information Disclosure Vulnerability
A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Trend Micro Control Manager. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within processing of AdHocQueryProcessor. Due to the improper restriction of XML External Entity (XXE) reference, a specially crafted URI causes the XML parser to access the contents of this URI and embed these contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose sensitive information under the context of the Network Service account.
— ZDI
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2018-3600.
What is the severity of CVE-2018-3600?
The severity of CVE-2018-3600 is medium (6.5).
Which product is affected by CVE-2018-3600?
Trend Micro Control Manager version 6.0 is affected by CVE-2018-3600.
How can remote attackers exploit CVE-2018-3600?
Remote attackers can exploit CVE-2018-3600 by bypassing the existing authentication mechanism and disclosing sensitive information on vulnerable installations of Trend Micro Control Manager.
Is authentication required to exploit CVE-2018-3600?
Yes, authentication is required to exploit CVE-2018-3600, but the existing authentication mechanism can be bypassed.