New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it's different from CVSS.
VPR Score: 7.4
SynopsisThe remote host is running an application that is affected by multiple vulnerabilities.
DescriptionThe Trend Micro InterScan Web Security Virtual Appliance is affected by multiple vulnerabilities :
- A path traversal vulnerability exists in the Apache Solr application due to improper validation of a user-supplied path prior to using it in file operations when parsing the file parameter in an HTTP request. An unauthenticated, remote attacker (when combined with CVE-2020-8606) can exploit this, by sending a URI that contains path traversal characters, to disclose the contents of arbitrary files. (CVE-2020-8604)
- An authentication bypass vulnerability exists in the HTTP proxy service due to its ability to communicate with internal services on the same host. An unauthenticated, remote attacker can exploit this, by sending requests through the proxy, to access other services that are otherwise inaccessible. (CVE-2020-8606)
Note that the appliance is reportedly affected by other vulnerabilities; however, this plugin has not tested for those issues.
SolutionUpgrade to the IWSVA version 6.5 build 1901 or later.