CVE-2020-8461 Cross-site request forgery in Trend Micro InterScan Web Security Virtual Appliance
Attackers can bypass CSRF protections to force victims to send unauthorized requests to the Trend Micro InterScan Web Security Virtual Appliance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-8461?
CVE-2020-8461 is a high-severity vulnerability in Trend Micro InterScan Web Security Virtual Appliance, published on 17 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a victim's browser to send a specifically encoded request without requiring a valid CSRF token.
Weakness: CWE-352
Which versions are affected by CVE-2020-8461?
It affects 1 product.
Products include Trendmicro Interscan Web Security Virtual Appliance.
How do I fix CVE-2020-8461?
No fix has been published for CVE-2020-8461 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-8461 being exploited?
There is no known exploitation of CVE-2020-8461 in the wild and no public exploit code.
Other vulnerabilities in Trend Micro InterScan Web Security Virtual Appliance
- CVE-2016-9269 Command injection in n/a
- CVE-2020-8465 Auth bypass in Trend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8466 Command injection in Trend Micro InterScan Web Security Virtual Appliance
- CVE-2020-28578 Memory corruption in Trend Micro InterScan Web Security Virtual Appliance
- CVE-2020-8606 Auth bypass in Trend Micro InterScan Web Security Virtual Appliance
Sources
Also known as GHSA-784w-4q35-257w.