CVE-2024-46902

A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive information affected installations. Please note: an attacker must first obtain the ability to execute high-privileged code (admin user rights) on the target system in order to exploit this vulnerability.

CVSS v3 8.4 HIGH

8.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.7 / Impact : 6.0

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://success.trendmicro.com/en-US/solution/KA-0017793	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-1227/	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:trendmicro:deep_discovery_inspector::::::::
	cpe:2.3:a:trendmicro:deep_discovery_inspector:6.6:1078::::::
	cpe:2.3:a:trendmicro:deep_discovery_inspector:6.6:1080::::::
	cpe:2.3:a:trendmicro:deep_discovery_inspector:6.7:1077::::::
	cpe:2.3:a:trendmicro:deep_discovery_inspector:6.7:1086::::::

History

No history.

Information

Published : 2024-10-22 19:15

Updated : 2024-10-25 14:50

NVD link : CVE-2024-46902

Mitre link : CVE-2024-46902

CVE.ORG link : CVE-2024-46902

JSON object : View

Products Affected

trendmicro

deep_discovery_inspector

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-46902", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@trendmicro.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "published": "2024-10-22T19:15:06.130", "references": [{"url": "https://success.trendmicro.com/en-US/solution/KA-0017793", "tags": ["Vendor Advisory"], "source": "security@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1227/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-89"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above could allow an attacker to disclose sensitive information affected installations.\r\n\r\nPlease note: an attacker must first obtain the ability to execute high-privileged code (admin user rights) on the target system in order to exploit this vulnerability."}, {"lang": "es", "value": " Una vulnerabilidad en Trend Micro Deep Discovery Inspector (DDI) versiones 5.8 y posteriores podr\u00eda permitir a un atacante divulgar informaci\u00f3n confidencial de las instalaciones afectadas. Tenga en cuenta que un atacante primero debe obtener la capacidad de ejecutar c\u00f3digo con privilegios elevados (derechos de usuario administrador) en el sistema de destino para aprovechar esta vulnerabilidad."}], "lastModified": "2024-10-25T14:50:23.897", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:deep_discovery_inspector:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "77ED7D00-6C55-4F2D-A97F-2A8AB569BCF9", "versionEndExcluding": "6.6", "versionStartIncluding": "5.8"}, {"criteria": "cpe:2.3:a:trendmicro:deep_discovery_inspector:6.6:1078:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE216061-F408-439A-90DC-9880010B2D58"}, {"criteria": "cpe:2.3:a:trendmicro:deep_discovery_inspector:6.6:1080:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A1E1C9C3-7A9B-4661-BF34-ABECD8A64C83"}, {"criteria": "cpe:2.3:a:trendmicro:deep_discovery_inspector:6.7:1077:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F359F80-0A0A-4A1D-BC4E-3C8C0A2C4063"}, {"criteria": "cpe:2.3:a:trendmicro:deep_discovery_inspector:6.7:1086:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E125CD6-99D1-4C4C-9FB6-ADDBB7EB380D"}], "operator": "OR"}]}], "sourceIdentifier": "security@trendmicro.com"}