{"api_version":"1","generated_at":"2026-07-23T20:14:29+00:00","cve":"CVE-2020-8466","urls":{"html":"https://cve.report/CVE-2020-8466","api":"https://cve.report/api/cve/CVE-2020-8466.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-8466","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-8466"},"summary":{"title":"CVE-2020-8466","description":"A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password.","state":"PUBLIC","assigner":"security@trendmicro.com","published_at":"2020-12-17 21:15:00","updated_at":"2021-07-21 11:39:00"},"problem_types":["CWE-78"],"metrics":[],"references":[{"url":"https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/","name":"N/A","refsource":"N/A","tags":["Exploit","Third Party Advisory"],"title":"Multiple critical vulnerabilities in Trend Micro InterScan Web Security Virtual Appliance (IWSVA)","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://success.trendmicro.com/solution/000283077","name":"N/A","refsource":"N/A","tags":["Vendor Advisory"],"title":"SECURITY BULLETIN:  December 2020 Security Bulletin for Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8466","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8466","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"8466","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"trendmicro","cpe5":"interscan_web_security_virtual_appliance","cpe6":"6.5","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"8466","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"trendmicro","cpe5":"interscan_web_security_virtual_appliance","cpe6":"6.5","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security@trendmicro.com","ID":"CVE-2020-8466","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Trend Micro InterScan Web Security Virtual Appliance","version":{"version_data":[{"version_value":"6.5 SP2"}]}}]},"vendor_name":"Trend Micro"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Unauthenticated Command Injection"}]}]},"references":{"reference_data":[{"url":"https://success.trendmicro.com/solution/000283077","refsource":"MISC","name":"https://success.trendmicro.com/solution/000283077"},{"url":"https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/","refsource":"MISC","name":"https://sec-consult.com/vulnerability-lab/advisory/multiple-critical-vulnerabilities-in-trend-micro-interscan-web-security-virtual-appliance/"}]}},"nvd":{"publishedDate":"2020-12-17 21:15:00","lastModifiedDate":"2021-07-21 11:39:00","problem_types":["CWE-78"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:trendmicro:interscan_web_security_virtual_appliance:6.5:sp2:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"8466","Ordinal":"168805","Title":"CVE-2020-8466","CVE":"CVE-2020-8466","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"8466","Ordinal":"1","NoteData":"A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"8466","Ordinal":"2","NoteData":"2020-12-17","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"8466","Ordinal":"3","NoteData":"2020-12-17","Type":"Other","Title":"Modified"}]}}}