A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:NTrellix Enterprise Security Manager
APPTrellix11.6.10
Powiązane podatności
RCE przez command injection w Trellix Enterprise Security Manager (ESM 11.6.10)
An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9...
An OS common injection vulnerability exists in the ESM certificate API, whereby incorrectly neutralized speci...
A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomple...
A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authentica...