CVE-2019-15626 Information disclosure in Deep Security Manager
Attackers can intercept initial LDAP credentials transmitted in clear text if the Deep Security Manager is configured incorrectly.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-15626?
CVE-2019-15626 is a high-severity vulnerability in Trend Micro Deep Security Manager, published on 17 Oct 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or availability.
Weakness: CWE-319
Which versions are affected by CVE-2019-15626?
It affects 1 product.
Products include Trendmicro Deep Security.
How do I fix CVE-2019-15626?
No fix has been published for CVE-2019-15626 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-15626 being exploited?
There is no known exploitation of CVE-2019-15626 in the wild and no public exploit code.
Other vulnerabilities in Trend Micro Deep Security Manager
Sources
Also known as GHSA-mhq3-m935-jrw4.