CVE-2016-1223 Path traversal in n/a

What is CVE-2016-1223?

CVE-2016-1223 is a medium-severity path traversal vulnerability in Trendmicro Officescan, published on 19 Jun 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Directory traversal vulnerability in Trend Micro Office Scan 11.0, Worry-Free Business Security Service 5.x, and Worry-Free Business Security 9.0 allows remote attackers to read arbitrary files via unspecified vectors.

Weakness: CWE-22

Which versions are affected by CVE-2016-1223?

It affects 3 products.

Products include Trendmicro Officescan, Trendmicro Worry-Free Business Security, Trendmicro Worry-Free Business Security Services.

How do I fix CVE-2016-1223?

No fix has been published for CVE-2016-1223 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2016-1223 being exploited?

There is no known exploitation of CVE-2016-1223 in the wild and no public exploit code.

Other vulnerabilities in Trendmicro Officescan

• CVE-2019-18187 Trend Micro OfficeScan Directory Traversal Exploited High 8.8
• CVE-2017-14089 Memory corruption in Trend Micro OfficeScan Critical 9.8
• CVE-2017-11393 Command injection in Trend Micro OfficeScan Critical 9.8
• CVE-2017-11394 Command injection in Trend Micro OfficeScan Critical 9.8
• CVE-2018-10508 Privilege escalation in Trend Micro OfficeScan High 8.8

All Trendmicro Officescan vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-558w-72f6-cp4j.