CVE-2020-28577: Trend Micro Apex One Improper Access Control Information Disclosure Vulnerability
An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro Apex One. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web console, which listens on TCP port 4343 by default. The issue results from improper access control. An attacker can leverage this vulnerability to disclose information from the application.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-28577?
CVE-2020-28577 is an improper access control information disclosure vulnerability in Trend Micro Apex One.
How does CVE-2020-28577 impact affected installations of Trend Micro Apex One?
CVE-2020-28577 allows remote attackers to disclose sensitive information without authentication on affected installations of Trend Micro Apex One.
What software is affected by CVE-2020-28577?
CVE-2020-28577 affects Trend Micro Apex One 2019 and Trend Micro Apex One and Worry-Free Business Security, as well as Trendmicro Officescan xg-sp1.
What is the severity of CVE-2020-28577?
CVE-2020-28577 has a severity rating of medium with a CVSS score of 5.3.
How can I fix the CVE-2020-28577 vulnerability?
To fix the CVE-2020-28577 vulnerability, it is recommended to apply the patches and updates provided by Trend Micro.