CVE-2018-3600

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A external entity processing information disclosure (XXE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to disclose sensitive information on vulnerable installations.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Control Manager	6.0

References

https://success.trendmicro.com/solution/1119158Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-18-111/Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/1119158Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-18-111/Third Party Advisory, VDB Entry

Timeline

Published: Feb 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-36019.8A password hash usage authentication bypass vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to bypass authent CVE-2018-36028.8An AdHocQuery_Processor SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote atta CVE-2018-36038.8A CGGIServlet SQL injection remote code execution (RCE) vulnerability in Trend Micro Control Manager 6.0 could allow a remote attacker to ex CVE-2018-36048.8GetXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacker to CVE-2018-36058.8TopXXX, ViolationXXX, and IncidentXXX method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 co CVE-2018-36068.8XXXStatusXXX, XXXSummary, TemplateXXX and XXXCompliance method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Cont CVE-2018-36078.8XXXTreeNode method SQL injection remote code execution (RCE) vulnerabilities in Trend Micro Control Manager 6.0 could allow a remote attacke CVE-2018-36089.8A vulnerability in Trend Micro Maximum Security's (Consumer) 2018 (versions 12.0.1191 and below) User-Mode Hooking (UMH) driver could allow CVE-2018-36098.1A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticat CVE-2018-36106.0SEMA driver in Intel Driver and Support Assistant before version 3.1.1 allows a local attacker the ability to read and writing to Memory Sta CVE-2018-36116.5Bounds check vulnerability in User Mode Driver in Intel Graphics Driver 15.40.x.4 and 21.20.x.x allows unprivileged user to cause a denial o CVE-2018-36127.8Intel NUC kits with insufficient input validation in system firmware, potentially allows a local attacker to elevate privileges to System Ma