← CVE Radar
CVE-2019-18187Trend Micro OfficeScan Directory Traversal Vulnerability
Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account, which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.
8.8 HIGHEPSS 25.12%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1CISA-ADP | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 7.5 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 5.0 | MEDIUM | 2.0NVD | AV:N/AC:L/Au:N/C:P/I:N/A:N |
CISA required action
⚡ Known exploited · remediation due May 3, 2022
Apply updates per vendor instructions.
Details
- CVE ID
- CVE-2019-18187
- Status
- Analyzed
- Assigner (CNA)
- trendmicro
- Published
- Oct 28, 2019
- Last modified
- 2026-06-17 02:24 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
Trend MicroTrend Micro OfficeScan1 version range
- Version 11.0, XG (12.0)