9.8crit
CVE-2018-6229in critical feed1 exploit
A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL comm…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
10.2%
percentile 96%
Public exploits
1
Exploit-DB
Summary
A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system.
Exploit prediction (EPSS)
10.25% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
Exploits and detections
- EDB-44166 Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities · webapps · 2018-02-22
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Trend Micro Trend Micro Email Encryption Gateway
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- exploit-db.com /exploits/44166/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- success.trendmicro.com /solution/1119349 · x_refsource_CONFIRM, x_transferred
- coresecurity.com /advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-6229
- NVD: CVE-2018-6229
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.