CVE-2019-9488

MEDIUM

Trend Micro Deep Security Manager 10.x-11.x and Vulnerability Protection 2.0 - XML External Entity Injection

Title source: manual
STIX 2.1

Description

Trend Micro Deep Security Manager (10.x, 11.x) and Vulnerability Protection (2.0) are vulnerable to a XML External Entity Attack. However, for the attack to be possible, the attacker must have root/admin access to a protected host which is authorized to communicate with the Deep Security Manager (DSM).

References (1)

Core 1
Core References
Patch, Vendor Advisory x_refsource_confirm
https://success.trendmicro.com/solution/1122900

Scores

CVSS v3 4.9
EPSS 0.0060
EPSS Percentile 69.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-611
Status published
Products (4)
trendmicro/deep_security_manager 10.0 (20 CPE variants)
trendmicro/deep_security_manager 11.0 (8 CPE variants)
trendmicro/deep_security_manager 11.3
trendmicro/vulnerability_protection 2.0
Published Sep 11, 2019
Tracked Since Feb 18, 2026