CVE-2020-28576

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal version and build information.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro Apex One	2019
Trend Micro	Trend Micro OfficeScan	XG SP1

References

https://success.trendmicro.com/solution/000281947Vendor Advisory
https://success.trendmicro.com/solution/000281949Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1375/Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/000281947Vendor Advisory
https://success.trendmicro.com/solution/000281949Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-1375/Third Party Advisory, VDB Entry

Timeline

Published: Dec 1, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-285775.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285789.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a sp CVE-2020-285798.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a spec CVE-2020-28588.2Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). Supported versions that are CVE-2020-285807.2A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticate CVE-2020-285817.2A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authentic CVE-2020-285825.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285835.3An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated CVE-2020-285877.8A specially crafted document can cause the document parser to copy data from a particular record type into a static-sized buffer within an o CVE-2020-285885.5An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifical CVE-2020-285898.8An improper array index validation vulnerability exists in the LoadObj functionality of tinyobjloader v2.0-rc1 and tinyobjloader development CVE-2020-28597.5Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: nVision). Supported versions that are affect