CVE-2020-15605: Trend Micro Vulnerability Protection Authentication Bypass Vulnerability
First published: Thu Aug 27 2020(Updated: )
If LDAP authentication is enabled, an LDAP authentication bypass vulnerability in Trend Micro Vulnerability Protection 2.0 SP2 could allow an unauthenticated attacker with prior knowledge of the targeted organization to bypass manager authentication. Enabling multi-factor authentication prevents this attack. Installations using manager native authentication or SAML authentication are not impacted by this vulnerability.
Credit: security@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trend Micro Vulnerability Protection | ||
| trendmicro deep security manager | =10.0 | |
| trendmicro deep security manager | =11.0 | |
| trendmicro deep security manager | =12.0 | |
| Trend Micro Vulnerability Protection | =2.0-sp2 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-15605?
CVE-2020-15605 has a medium severity rating, indicating a considerable risk if exploited.
How do I fix CVE-2020-15605?
To fix CVE-2020-15605, it is recommended to apply the latest patches provided by Trend Micro for Vulnerability Protection 2.0 SP2.
Who is affected by CVE-2020-15605?
CVE-2020-15605 affects users of Trend Micro Vulnerability Protection 2.0 SP2 and certain versions of Deep Security Manager.
Can CVE-2020-15605 be exploited remotely?
Yes, CVE-2020-15605 can be exploited remotely by an unauthenticated attacker with knowledge of the organization's LDAP setup.
What are the potential impacts of CVE-2020-15605?
The potential impact of CVE-2020-15605 includes unauthorized bypass of manager authentication, leading to unauthorized access to the system.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/author
- agent/severity
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-20-1083
- alias/ZDI-CAN-11431
- alias/CVE-2020-15605
- agent/software-canonical-lookup
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/trend micro
- canonical/trend micro vulnerability protection
- vendor/trendmicro
- canonical/trendmicro deep security manager
- version/trendmicro deep security manager/10.0
- version/trendmicro deep security manager/11.0
- version/trendmicro deep security manager/12.0
- version/trend micro vulnerability protection/2.0-sp2
- vendor/microsoft
- canonical/microsoft windows