CVE-2020-28574

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A unauthenticated path traversal arbitrary remote file deletion vulnerability in Trend Micro Worry-Free Business Security 10 SP1 could allow an unauthenticated attacker to exploit the vulnerability and modify or delete arbitrary files on the product's management console.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Worry-Free Business Security	10.0 SP1

References

https://success.trendmicro.com/solution/000281948Vendor Advisory
https://www.tenable.com/security/research/tra-2020-62Exploit, Third Party Advisory
https://success.trendmicro.com/solution/000281948Vendor Advisory
https://www.tenable.com/security/research/tra-2020-62Exploit, Third Party Advisory

Timeline

Published: Nov 18, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-285756.7A heap-based buffer overflow privilege escalation vulnerability in Trend Micro ServerProtect for Linux 3.0 may allow an attacker to escalate CVE-2020-285765.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285775.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285789.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a sp CVE-2020-285798.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a spec CVE-2020-28588.2Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are CVE-2020-285807.2A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticate CVE-2020-285817.2A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authentic CVE-2020-285825.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285835.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285877.8A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an o CVE-2020-285885.5An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifical