CVE-2019-18187
Trend Micro OfficeScan Directory Traversal Vulnerability
Description
CVE-2019-18187 is a high-severity directory traversal vulnerability in Trend Micro OfficeScan. Affected versions 11.0 and XG (12.0) allow attackers to extract files from an arbitrary zip file to a specific folder on the OfficeScan server by exploiting a path traversal flaw, potentially leading to remote code execution. The vulnerability is classified under CWE-22 (Path Traversal), as the application fails to properly validate file paths during zip extraction. CISA has added CVE-2019-18187 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. With an EPSS score of 78.45% (99.02nd percentile), there is a very high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| trendmicro | officescan | 11.0; xg |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://success.trendmicro.com/solution/000151730(Broken Link, Vendor Advisory)
- https://web.archive.org/web/20200215171235/https://success.trendmicro.com/solution/000151730(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-18187(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
Path Traversal occurs when software uses external input to construct a pathname but fails to properly neutralize special elements like ".." that can resolve outside the intended directory. In Trend Micro OfficeScan, the zip extraction mechanism does not adequately validate file paths within archive contents, allowing an attacker to write files to arbitrary locations on the server by crafting a malicious zip file with traversal sequences.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
Impact Analysis
CVE-2019-18187 carries a CVSS 3.1 score of 7.5 (HIGH), representing a significant security risk. The vulnerability is remotely exploitable over the network with low attack complexity and requires no authentication or user interaction, making it particularly dangerous. Confidentiality (High) is severely impacted, as attackers can extract sensitive files from the server including configuration data and credentials. While integrity and availability are not directly affected according to the CVSS metrics, the directory traversal can serve as a stepping stone to remote code execution when combined with file write capabilities. The EPSS score of 78.45% places this vulnerability in the 99.02nd percentile, indicating a very high likelihood of active exploitation. Organizations running Trend Micro OfficeScan versions 11.0 or XG without patches face significant risk of data exposure and potential system compromise.
Exploit Maturity
CVE-2019-18187 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 78.45% (99.02nd percentile) indicates a very high probability of exploitation activity. While no public proof-of-concept exploits are directly linked in the NVD references, Trend Micro’s advisory confirms that the vulnerability has been observed in active attacks targeting OfficeScan deployments. The combination of network accessibility, no authentication requirement, and the potential path from directory traversal to remote code execution makes this vulnerability highly attractive to threat actors.
Remediation
- Apply vendor patches immediately as required by CISA KEV. Install the security updates provided by Trend Micro for OfficeScan versions 11.0 and XG (12.0) as documented in the vendor advisory.
- Verify that all Trend Micro OfficeScan installations have been updated to patched versions. Specifically check OfficeScan 11.0 and XG deployments across the organization for proper patch status.
- Restrict network access to OfficeScan server management interfaces using firewall rules and network segmentation, limiting connections to authorized administrators only.
- Monitor OfficeScan server logs for suspicious file extraction activities, unexpected zip file operations, and unauthorized file modifications in server directories that could indicate exploitation attempts.
- Implement file integrity monitoring on the OfficeScan server to detect unauthorized file writes, and ensure that the web service account running OfficeScan operates with minimal file system permissions to limit the impact of successful exploitation.
Technical Details
CVE-2019-18187 exploits a directory traversal weakness in Trend Micro OfficeScan’s handling of zip file extraction. The vulnerability allows an attacker to craft a malicious zip archive containing file entries with path traversal sequences (such as "../") that, when extracted by OfficeScan, write files to locations outside the intended extraction directory. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms the attack is network-based, requires no privileges or user interaction, and primarily impacts confidentiality. While the NVD description notes that the remote process execution is bound to a web service account with potentially restricted permissions, the ability to write arbitrary files to the server can be leveraged for remote code execution depending on the server configuration. The vulnerability affects OfficeScan versions 11.0 and XG, and Trend Micro’s advisory indicates that user authentication is required to attempt the attack, though the NVD primary scoring rates privileges required as NONE.
Frequently Asked Questions
Is CVE-2019-18187 being actively exploited?
Yes. CVE-2019-18187 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 78.45% (99.02nd percentile) further indicates a very high probability of exploitation.
What products are affected by CVE-2019-18187?
CVE-2019-18187 affects Trend Micro OfficeScan versions 11.0 and XG (12.0). Organizations using either of these versions should verify their patch status immediately.
How do I fix CVE-2019-18187?
Apply the security updates from Trend Micro for OfficeScan versions 11.0 and XG as documented in the vendor advisory. As an interim measure, restrict network access to OfficeScan server management interfaces and implement file integrity monitoring.
How severe is CVE-2019-18187?
CVE-2019-18187 has a CVSS 3.1 score of 7.5 (HIGH). It enables remote directory traversal without authentication, potentially leading to remote code execution. The EPSS score in the 99.02nd percentile indicates it is among the most likely vulnerabilities to be exploited.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.