Credentials management in InterScan Web Security Virtual Appliance (IWSVA) - CVE-2019-9490
Published: April 6, 2019 / Updated: August 8, 2020
Vulnerability identifier: #VU36024
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-9490
CWE-ID: CWE-255
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to execute arbitrary code.
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance version 6.5 SP2 could allow an non-authorized user to disclose administrative credentials. An attacker must be an authenticated user in order to exploit the vulnerability.
Affected software
InterScan Web Security Virtual Appliance (IWSVA)
How to mitigate CVE-2019-9490
Install update from vendor's website.