CVE-2019-9488: XEE

Published Sep 11, 2019

Updated

Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM).

Affected Software

30 affected components

trendmicro Deep Security Manager=10.0

trendmicro Deep Security Manager=10.0-u1

trendmicro Deep Security Manager=10.0-u10

trendmicro Deep Security Manager=10.0-u11

trendmicro Deep Security Manager=10.0-u12

trendmicro Deep Security Manager=10.0-u13

trendmicro Deep Security Manager=10.0-u14

trendmicro Deep Security Manager=10.0-u15

trendmicro Deep Security Manager=10.0-u16

trendmicro Deep Security Manager=10.0-u17

trendmicro Deep Security Manager=10.0-u18

trendmicro Deep Security Manager=10.0-u19

trendmicro Deep Security Manager=10.0-u2

trendmicro Deep Security Manager=10.0-u3

trendmicro Deep Security Manager=10.0-u4

trendmicro Deep Security Manager=10.0-u5

trendmicro Deep Security Manager=10.0-u6

trendmicro Deep Security Manager=10.0-u7

trendmicro Deep Security Manager=10.0-u8

trendmicro Deep Security Manager=10.0-u9

trendmicro Deep Security Manager=11.0

trendmicro Deep Security Manager=11.0-u1

trendmicro Deep Security Manager=11.0-u2

trendmicro Deep Security Manager=11.0-u3

trendmicro Deep Security Manager=11.0-u4

trendmicro Deep Security Manager=11.0-u5

trendmicro Deep Security Manager=11.0-u6

trendmicro Deep Security Manager=11.0-u7

trendmicro Deep Security Manager=11.3

trendmicro Vulnerability Protection=2.0

Remediation

Patch Available

https://success.trendmicro.com/solution/1122900

Event History

Sep 11, 2019

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-9488?

CVE-2019-9488 is classified as a critical severity vulnerability that can enable an XML External Entity Attack.

How do I fix CVE-2019-9488?

To remediate CVE-2019-9488, you must update Trend Micro Deep Security Manager and Vulnerability Protection to the latest patched versions.

Which versions of Trend Micro software are affected by CVE-2019-9488?

CVE-2019-9488 affects Trend Micro Deep Security Manager versions 10.x and 11.x, and Vulnerability Protection version 2.0.

Can the XML External Entity Attack be executed remotely in CVE-2019-9488?

For an XML External Entity Attack related to CVE-2019-9488 to succeed, the attacker must have root or admin access to the protected host.

What type of attack does CVE-2019-9488 involve?

CVE-2019-9488 involves an XML External Entity Attack that can potentially expose sensitive information.