CVE-2018-3609: High severity trend micro interscan messaging security virtual appliance vulnerability

Published Feb 16, 2018

Updated

A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations.

Affected Software

2 affected components

trendmicro Interscan Messaging Security Virtual Appliance=9.0

trendmicro Interscan Messaging Security Virtual Appliance=9.1

Event History

Feb 16, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-3609?

The severity of CVE-2018-3609 is high, with a CVSS score of 8.1.

How can an unauthenticated user exploit CVE-2018-3609?

An unauthenticated user can exploit CVE-2018-3609 by accessing a sensitive log file that could be used to bypass authentication.

Which versions of Trend Micro InterScan Messaging Security Virtual Appliance are affected by CVE-2018-3609?

Versions 9.0 and 9.1 of Trend Micro InterScan Messaging Security Virtual Appliance are affected by CVE-2018-3609.

Is there a workaround for CVE-2018-3609?

Currently, there is no known workaround for CVE-2018-3609.

Where can I find more information about CVE-2018-3609?

You can find more information about CVE-2018-3609 at the following references: [http://www.securityfocus.com/bid/103097](http://www.securityfocus.com/bid/103097), [https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt](https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt), [https://success.trendmicro.com/jp/solution/1119290](https://success.trendmicro.com/jp/solution/1119290).