What’s Vulnerable › Vulnerabilities

CVE-2020-27017

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-11-09 · updated 2026-06-17
• Weakness: CWE-611

Description

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.

Affected products

• Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA): through 9.1

References

• https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/
• https://success.trendmicro.com/solution/000279833
• https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/
• https://success.trendmicro.com/solution/000279833

Get alerted when CVE-2020-27017 or the next vulnerability affects your stack