ZDI-20-678: Trend Micro InterScan Web Security Virtual Appliance Apache Solr Directory Traversal Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Trend Micro InterScan Web Security Virtual Appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Apache Solr application. When parsing the file parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of IWSS user.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-20-678?
ZDI-20-678 is classified as a critical vulnerability allowing remote information disclosure.
How do I fix ZDI-20-678?
To remediate ZDI-20-678, apply the latest security patches provided by Trend Micro for the InterScan Web Security Virtual Appliance.
What type of attack can be performed due to ZDI-20-678?
ZDI-20-678 allows remote attackers to exploit the vulnerability without authentication to disclose sensitive information.
What software is affected by ZDI-20-678?
ZDI-20-678 affects Trend Micro InterScan Web Security Virtual Appliance installations.
Is authentication required to exploit ZDI-20-678?
No, ZDI-20-678 can be exploited without requiring authentication.