CVE-2019-18189 - A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow an attacker to bypass authentication and log on to an affected product's management console as a root user · CoreCVE

Back Back to CVE browser

CRITICAL

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow an attacker to bypass authentication and log on to an affected product's management console as a root user

Published Oct 28, 2019

9.8

CRITICAL

CVSS 3.1

EPSS 4.54%

Description

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan (11.0, XG) and Worry-Free Business Security (9.5, 10.0) may allow an attacker to bypass authentication and log on to an affected product's management console as a root user. The vulnerability does not require authentication.

Affected products

Vendor Trend Micro Product n/a Default
n/a
- Version
  Apex One (All), OSCE (11.0, XG), WFBS (9.5, 10.0)
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

n/a

Version	Status	Constraints
Apex One (All), OSCE (11.0, XG), WFBS (9.5, 10.0)	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7992
Advisory
https://success.trendmicro.com/solution/000151732
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-7992		Advisory
https://success.trendmicro.com/solution/000151732		x_refsource_MISCVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner trendmicro

Published Oct 28, 2019

Updated Aug 5, 2024

Reserved Oct 17, 2019

Link CVE-2019-18189

CISA Vulnrichment

Updated n/a

Status Modified

Modified Jun 17, 2026

Link CVE-2019-18189

Severity n/a

Public date n/a

Links CVE-2019-18189

Assigner trendmicro

Published Oct 28, 2019

Updated Aug 5, 2024

Exploited since n/a

Link EUVD-2019-7992