CVE-2020-27017

4.9 mediumEPSS 6.5%

Medium (4.9) in trendmicro interscan messaging security virtual appliance. EPSS 6.5% chance of exploitation in the next 30 days.

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.

Severity

CVSS 3.1

4.9 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

EPSS: 6.5% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2020-11-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

trendmicro:interscan_messaging_security_virtual_appliance

References

https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/
https://success.trendmicro.com/solution/000279833
https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva/
https://success.trendmicro.com/solution/000279833

Check your stack JSON