Details of VAR-201805-0277

ID

VAR-201805-0277

CVE

CVE-2018-10356

TITLE

Trend Micro Email Encryption Gateway In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-005208

DESCRIPTION

A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability. When parsing the hidDomains parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database

Trust: 2.61

sources: NVD: CVE-2018-10356 // JVNDB: JVNDB-2018-005208 // ZDI: ZDI-18-420 // BID: 104342 // VULHUB: VHN-120107

AFFECTED PRODUCTS

vendor:	trendmicro	model:	email encryption gateway	scope:	lte	version:	5.5	Trust: 1.0
vendor:	trend micro	model:	email encryption gateway	scope:	eq	version:	5.5	Trust: 0.8
vendor:	trend micro	model:	encryption for email gateway	scope:	-	version:	-	Trust: 0.7
vendor:	trendmicro	model:	email encryption gateway	scope:	eq	version:	5.5	Trust: 0.6
vendor:	trend micro	model:	email encryption gateway build	scope:	eq	version:	5.51111	Trust: 0.3
vendor:	trend micro	model:	email encryption gateway build	scope:	eq	version:	5.51107	Trust: 0.3
vendor:	trend micro	model:	email encryption gateway build	scope:	eq	version:	5.51073	Trust: 0.3
vendor:	trend micro	model:	email encryption gateway build	scope:	ne	version:	5.51129	Trust: 0.3

sources: ZDI: ZDI-18-420 // BID: 104342 // JVNDB: JVNDB-2018-005208 // CNNVD: CNNVD-201805-774 // NVD: CVE-2018-10356

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-10356
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-10356
value:	HIGH
Trust: 0.8
ZDI:	CVE-2018-10356
value:	HIGH
Trust: 0.7
CNNVD:	CNNVD-201805-774
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-120107
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-10356
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 2.5
VULHUB:	VHN-120107
severity:	HIGH
baseScore:	9.0
vectorString:	AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-10356
baseSeverity:	HIGH
baseScore:	8.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: ZDI: ZDI-18-420 // VULHUB: VHN-120107 // JVNDB: JVNDB-2018-005208 // CNNVD: CNNVD-201805-774 // NVD: CVE-2018-10356

PROBLEMTYPE DATA

problemtype:

CWE-89

Trust: 1.9

sources: VULHUB: VHN-120107 // JVNDB: JVNDB-2018-005208 // NVD: CVE-2018-10356

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201805-774

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201805-774

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-005208

PATCH

title:	1119349	url:	https://success.trendmicro.com/solution/1119349	Trust: 1.5
title:	Trend Micro Email Encryption SQL Repair measures for injecting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=83659	Trust: 0.6

sources: ZDI: ZDI-18-420 // JVNDB: JVNDB-2018-005208 // CNNVD: CNNVD-201805-774

EXTERNAL IDS

db:	NVD	id:	CVE-2018-10356	Trust: 3.5
db:	ZDI	id:	ZDI-18-420	Trust: 2.7
db:	JVNDB	id:	JVNDB-2018-005208	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-5592	Trust: 0.7
db:	NSFOCUS	id:	39858	Trust: 0.6
db:	CNNVD	id:	CNNVD-201805-774	Trust: 0.6
db:	BID	id:	104342	Trust: 0.4
db:	VULHUB	id:	VHN-120107	Trust: 0.1

sources: ZDI: ZDI-18-420 // VULHUB: VHN-120107 // BID: 104342 // JVNDB: JVNDB-2018-005208 // CNNVD: CNNVD-201805-774 // NVD: CVE-2018-10356

REFERENCES

url:	https://success.trendmicro.com/solution/1119349	Trust: 2.7
url:	https://www.zerodayinitiative.com/advisories/zdi-18-420/	Trust: 2.0
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-10356	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-10356	Trust: 0.8
url:	http://www.nsfocus.net/vulndb/39858	Trust: 0.6
url:	http://www.trend.com	Trust: 0.3

sources: ZDI: ZDI-18-420 // VULHUB: VHN-120107 // BID: 104342 // JVNDB: JVNDB-2018-005208 // CNNVD: CNNVD-201805-774 // NVD: CVE-2018-10356

CREDITS

Steven Seeley of Source Incite

Trust: 1.0

sources: ZDI: ZDI-18-420 // BID: 104342

SOURCES

db:	ZDI	id:	ZDI-18-420
db:	VULHUB	id:	VHN-120107
db:	BID	id:	104342
db:	JVNDB	id:	JVNDB-2018-005208
db:	CNNVD	id:	CNNVD-201805-774
db:	NVD	id:	CVE-2018-10356

LAST UPDATE DATE

2024-11-23T22:06:50.973000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-18-420	date:	2018-05-04T00:00:00
db:	VULHUB	id:	VHN-120107	date:	2018-06-22T00:00:00
db:	BID	id:	104342	date:	2018-02-21T00:00:00
db:	JVNDB	id:	JVNDB-2018-005208	date:	2018-07-10T00:00:00
db:	CNNVD	id:	CNNVD-201805-774	date:	2018-05-24T00:00:00
db:	NVD	id:	CVE-2018-10356	date:	2024-11-21T03:41:15.167

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-18-420	date:	2018-05-04T00:00:00
db:	VULHUB	id:	VHN-120107	date:	2018-05-23T00:00:00
db:	BID	id:	104342	date:	2018-02-21T00:00:00
db:	JVNDB	id:	JVNDB-2018-005208	date:	2018-07-10T00:00:00
db:	CNNVD	id:	CNNVD-201805-774	date:	2018-05-24T00:00:00
db:	NVD	id:	CVE-2018-10356	date:	2018-05-23T16:29:00.490