CVE-2020-15604

{"id": "CVE-2020-15604", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2020-09-24T02:15:12.313", "references": [{"url": "https://helpcenter.trendmicro.com/en-us/article/TMKA-09890", "tags": ["Vendor Advisory"], "source": "security@trendmicro.com"}, {"url": "https://helpcenter.trendmicro.com/ja-jp/article/TMKA-09673", "tags": ["Vendor Advisory"], "source": "security@trendmicro.com"}, {"url": "https://jvn.jp/en/jp/JVN60093979/", "tags": ["Third Party Advisory"], "source": "security@trendmicro.com"}, {"url": "https://jvn.jp/jp/JVN60093979/", "tags": ["Third Party Advisory"], "source": "security@trendmicro.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}, {"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-494: Update files are not properly verified."}, {"lang": "es", "value": "Una vulnerabilidad de comprobaci\u00f3n de certificaci\u00f3n de servidor SSL incompleta en la familia de productos de consumo Trend Micro Security 2019 versi\u00f3n (v15), podr\u00eda permitir a un atacante combinar esta vulnerabilidad con otro ataque para enga\u00f1ar a un cliente afectado para que descargue una actualizaci\u00f3n maliciosa en lugar de la prevista. CWE-494: Los archivos de actualizaci\u00f3n no se comprobaron apropiadamente."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:antivirus\\+_2019:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4234F518-EE9A-4A1E-981D-CFA188121129", "versionEndIncluding": "15.0"}, {"criteria": "cpe:2.3:a:trendmicro:internet_security_2019:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "513EDCB8-5DA5-491A-A455-24D3EF276F39", "versionEndIncluding": "15.0"}, {"criteria": "cpe:2.3:a:trendmicro:maximum_security_2019:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "547BBB52-510C-4932-9931-588BC0F00BD1", "versionEndIncluding": "15.0"}, {"criteria": "cpe:2.3:a:trendmicro:officescan_cloud:15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D4FDFB7-9F82-47F2-B265-916BFCE0A0EA"}, {"criteria": "cpe:2.3:a:trendmicro:premium_security_2019:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E106BCBA-067A-43DC-A9EB-D567464FD04E", "versionEndIncluding": "15.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@trendmicro.com"}