CVE-2018-10355

Severity: high (CVSS 7.0 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-23 · updated 2026-06-17
Weakness: CWE-522

Description

An authentication weakness vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to recover user passwords on vulnerable installations due to a flaw in the DBCrypto class. An attacker must first obtain access to the user database on the target system in order to exploit this vulnerability.

Affected products

Trend Micro Email Encryption Gateway: through 5.5

References

https://success.trendmicro.com/solution/1119349
https://www.zerodayinitiative.com/advisories/ZDI-18-411/
https://success.trendmicro.com/solution/1119349
https://www.zerodayinitiative.com/advisories/ZDI-18-411/

Get alerted when CVE-2018-10355 or the next vulnerability affects your stack