CVE-2019-18188
CVE-2019-18188
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 4.7%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
28 Oct 2019Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One server, which could potentially lead to remote code execution (RCE). The remote process execution is bound to the IUSR account, which has restricted permission and is unable to make major system changes. An attempted attack requires user authentication.
Affected products
Trend Micro · Trend Micro Apex OneWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →