Trend Micro Email Encryption Gateway CVE-2018-6225 XML External Entity Injection Vulnerability

Bugtraq ID:	103437
Class:	Input Validation Error
CVE:	CVE-2018-6225
Remote:	Yes
Local:	No
Published:	Feb 21 2018 12:00AM
Updated:	Feb 21 2018 12:00AM
Credit:	Leandro Barragan and Maximilian Vidal for Core Security Consulting and Vahagn Vardanyan.
Vulnerable:	Trend Micro Email Encryption Gateway 5.5 build 1111 Trend Micro Email Encryption Gateway 5.5 build 1107 Trend Micro Email Encryption Gateway 5.5 build 1073
Not Vulnerable:	Trend Micro Email Encryption Gateway 5.5 build 1129

Trend Micro Email Encryption Gateway CVE-2018-6225 XML External Entity Injection Vulnerability

Trend Micro Email Encryption Gateway is prone to an XML External Entity injection vulnerability.

Attackers can exploit this issue to gain access to sensitive information or cause denial-of-service condition.

Trend Micro Email Encryption Gateway 5.5 Build 1111 and prior versions are vulnerable.

Trend Micro Email Encryption Gateway CVE-2018-6225 XML External Entity Injection Vulnerability

References:

• Trend Micro Homepage (Trend Micro)
  
• SECURITY BULLETIN: Trend Micro Email Encryption Gateway 5.5 Multiple Vulnerabili (Trend Micro)
  
• Trend Micro Email Encryption Gateway Multiple Vulnerabilities (coresecurity)