CVE-2019-18187: high-severity vulnerability in Trend Micro OfficeScan
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
A vulnerability in Trend Micro OfficeScan allows an authenticated attacker to extract files from zip archives to arbitrary locations on the server, potentially leading to remote code execution. This happens because the application doesn't properly validate file paths during extraction.
A path traversal vulnerability in OfficeScan's zip file extraction functionality allows authenticated attackers to write files to arbitrary directories on the server. The vulnerability is exploited through crafted zip files with directory traversal sequences (e.g., ../) that bypass path validation, potentially enabling RCE execution within the web service account's privilege context.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.