CVE-2018-15364

{"id": "CVE-2018-15364", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 1.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.0}]}, "published": "2018-08-30T19:29:01.107", "references": [{"url": "https://success.trendmicro.com/solution/1120678", "tags": ["Mitigation", "Vendor Advisory"], "source": "security@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-18-964/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a local attacker to disclose sensitive information on vulnerable installations. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability."}, {"lang": "es", "value": "Una vulnerabilidad de procesamiento de peticiones de tuber\u00edas nombradas, lectura fuera de l\u00edmites y divulgaci\u00f3n de informaci\u00f3n en Trend Micro OfficeScan XG (12.0) podr\u00eda permitir que un atacante local revele informaci\u00f3n sensible en instalaciones vulnerables. En primer lugar, un atacante debe obtener la habilidad para ejecutar c\u00f3digo de bajos privilegios en el sistema objetivo para explotar esta vulnerabilidad."}], "lastModified": "2018-11-08T15:10:46.967", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:officescan_xg:12.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15DDB5AE-D9F6-4972-B63F-E674489A93D8"}], "operator": "OR"}]}], "sourceIdentifier": "security@trendmicro.com"}