cvelistv5 - CVE-2019-15625

CVE-2019-15625

Vulnerability from cvelistv5

Published

2020-01-17 23:45

Modified

2024-08-05 00:56

Severity ?

Summary

A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.

References

URL	Tags
security@trendmicro.com	https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx	Vendor Advisory
security@trendmicro.com	https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx	Vendor Advisory
security@trendmicro.com	https://jvn.jp/en/jp/JVN49593434/index.html	Third Party Advisory
security@trendmicro.com	https://jvn.jp/jp/JVN49593434/index.html	Third Party Advisory

Impacted products

▼	Vendor	Product
	Trend Micro	Trend Micro Password Manager

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T00:56:22.076Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN49593434/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/jp/JVN49593434/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Trend Micro Password Manager",
          "vendor": "Trend Micro",
          "versions": [
            {
              "status": "affected",
              "version": "3.8.0.1103 and below "
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim\u0027s memory processes to extract sensitive information."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Memory Usage",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-17T23:45:24",
        "orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
        "shortName": "trendmicro"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/jp/JVN49593434/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/jp/JVN49593434/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@trendmicro.com",
          "ID": "CVE-2019-15625",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Trend Micro Password Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "3.8.0.1103 and below "
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Trend Micro"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim\u0027s memory processes to extract sensitive information."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Memory Usage"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx",
              "refsource": "MISC",
              "url": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN49593434/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/jp/JVN49593434/index.html"
            },
            {
              "name": "https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx",
              "refsource": "MISC",
              "url": "https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx"
            },
            {
              "name": "https://jvn.jp/jp/JVN49593434/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/jp/JVN49593434/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
    "assignerShortName": "trendmicro",
    "cveId": "CVE-2019-15625",
    "datePublished": "2020-01-17T23:45:24",
    "dateReserved": "2019-08-26T00:00:00",
    "dateUpdated": "2024-08-05T00:56:22.076Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-15625\",\"sourceIdentifier\":\"security@trendmicro.com\",\"published\":\"2020-01-18T00:15:12.000\",\"lastModified\":\"2021-07-21T11:39:23.747\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim\u0027s memory processes to extract sensitive information.\"},{\"lang\":\"es\",\"value\":\"Se presenta una vulnerabilidad de uso de memoria en Trend Micro Password Manager versi\u00f3n 3.8, que podr\u00eda permitir a un atacante con acceso y permisos a los procesos de la memoria de la v\u00edctima extraer informaci\u00f3n confidencial.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:N/A:N\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":2.1},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:trendmicro:password_manager:*:*:*:*:*:macos:*:*\",\"versionStartIncluding\":\"3.8\",\"versionEndIncluding\":\"3.8.0.1052\",\"matchCriteriaId\":\"9D4EE351-1F3F-4819-95A0-766F268F5784\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:trendmicro:password_manager:*:*:*:*:*:windows:*:*\",\"versionStartIncluding\":\"3.8\",\"versionEndIncluding\":\"3.8.0.1103\",\"matchCriteriaId\":\"0AA845C5-0D43-4F88-8F09-69A11DCCC5E8\"}]}]}],\"references\":[{\"url\":\"https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx\",\"source\":\"security@trendmicro.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx\",\"source\":\"security@trendmicro.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://jvn.jp/en/jp/JVN49593434/index.html\",\"source\":\"security@trendmicro.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://jvn.jp/jp/JVN49593434/index.html\",\"source\":\"security@trendmicro.com\",\"tags\":[\"Third Party Advisory\"]}]}}"
  }
}

ghsa-c3r6-j8rq-qj38

Vulnerability from github

Published

2022-05-24 17:06

Modified

2022-05-24 17:06

Details

A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2019-15625"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-01-18T00:15:00Z",
    "severity": "LOW"
  },
  "details": "A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim\u0027s memory processes to extract sensitive information.",
  "id": "GHSA-c3r6-j8rq-qj38",
  "modified": "2022-05-24T17:06:54Z",
  "published": "2022-05-24T17:06:54Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15625"
    },
    {
      "type": "WEB",
      "url": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx"
    },
    {
      "type": "WEB",
      "url": "https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN49593434/index.html"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/jp/JVN49593434/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

gsd-2019-15625

Vulnerability from gsd

Modified

2023-12-13 01:23

Details

A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.

Aliases

CVE-2019-15625

Aliases

CVE-2019-15625

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2019-15625",
    "description": "A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim\u0027s memory processes to extract sensitive information.",
    "id": "GSD-2019-15625"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2019-15625"
      ],
      "details": "A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim\u0027s memory processes to extract sensitive information.",
      "id": "GSD-2019-15625",
      "modified": "2023-12-13T01:23:38.938371Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@trendmicro.com",
        "ID": "CVE-2019-15625",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Trend Micro Password Manager",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "3.8.0.1103 and below "
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Trend Micro"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim\u0027s memory processes to extract sensitive information."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Memory Usage"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx",
            "refsource": "MISC",
            "url": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx"
          },
          {
            "name": "https://jvn.jp/en/jp/JVN49593434/index.html",
            "refsource": "MISC",
            "url": "https://jvn.jp/en/jp/JVN49593434/index.html"
          },
          {
            "name": "https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx",
            "refsource": "MISC",
            "url": "https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx"
          },
          {
            "name": "https://jvn.jp/jp/JVN49593434/index.html",
            "refsource": "MISC",
            "url": "https://jvn.jp/jp/JVN49593434/index.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:trendmicro:password_manager:*:*:*:*:*:macos:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.8.0.1052",
                "versionStartIncluding": "3.8",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:trendmicro:password_manager:*:*:*:*:*:windows:*:*",
                "cpe_name": [],
                "versionEndIncluding": "3.8.0.1103",
                "versionStartIncluding": "3.8",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@trendmicro.com",
          "ID": "CVE-2019-15625"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim\u0027s memory processes to extract sensitive information."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jvn.jp/jp/JVN49593434/index.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/jp/JVN49593434/index.html"
            },
            {
              "name": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1123595.aspx"
            },
            {
              "name": "https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx",
              "refsource": "MISC",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://esupport.trendmicro.com/support/pwm/solution/ja-jp/1123614.aspx"
            },
            {
              "name": "https://jvn.jp/en/jp/JVN49593434/index.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/en/jp/JVN49593434/index.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 2.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2021-07-21T11:39Z",
      "publishedDate": "2020-01-18T00:15Z"
    }
  }
}

CVE-2019-15625

Vulnerability from jvndb

Published

2020-01-17 15:01

Modified

2020-01-17 15:01

Severity ?

5.6 (Medium) - cvssV3_0 - CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

Trend Micro Password Manager vulnerable to information disclosure

Details

Password Manager provided by Trend Micro Incorporated contains an information disclosure vulnerability (CWE-200). Under certain conditions, the information ID, password etc. managed by Password Manager are kept on the memory in plaintext. They may be retrieved when the memory scan is done. Note that this vulnerability is different from JVN#37183636. BlackWingCat of PinkFlyingWhale reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN49593434/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15625
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2019-15625
	Information Exposure(CWE-200)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	Trend Micro, Inc.	Password Manager
	Trend Micro, Inc.	Password Manager

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000004.html",
  "dc:date": "2020-01-17T15:01+09:00",
  "dcterms:issued": "2020-01-17T15:01+09:00",
  "dcterms:modified": "2020-01-17T15:01+09:00",
  "description": "Password Manager provided by Trend Micro Incorporated contains an information disclosure vulnerability (CWE-200).\r\nUnder certain conditions, the information ID, password etc. managed by Password Manager are kept on the memory in plaintext. They may be retrieved when the memory scan is done.\r\n\r\nNote that this vulnerability is different from JVN#37183636.\r\n\r\nBlackWingCat of PinkFlyingWhale reported this vulnerability to IPA.\r\n JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2020/JVNDB-2020-000004.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:trendmicro:password_manager",
      "@product": "Password Manager",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:trendmicro:password_manager",
      "@product": "Password Manager",
      "@vendor": "Trend Micro, Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": [
    {
      "@score": "1.5",
      "@severity": "Low",
      "@type": "Base",
      "@vector": "AV:L/AC:M/Au:S/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "5.6",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2020-000004",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN49593434/index.html",
      "@id": "JVN#49593434",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15625",
      "@id": "CVE-2019-15625",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2019-15625",
      "@id": "CVE-2019-15625",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "Trend Micro Password Manager vulnerable to information disclosure"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2019-15625

Vulnerability from cvelistv5

ghsa-c3r6-j8rq-qj38

Vulnerability from github

gsd-2019-15625

Vulnerability from gsd

CVE-2019-15625

Vulnerability from jvndb

Tags

Sightings

Nomenclature