{"id":"CVE-2020-28577","aliases":["EUVD-2020-20975","GHSA-2cqx-cjpv-4c7m"],"status":"published","title":"An improper access control information disclosure vulnerability in Trend Micro Apex One and...","description":"An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03245,"percentile":0.88394,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2020-12-01T18:40:38Z","modified":"2026-06-17T03:10:33Z","products":[{"vendor":"trend micro","product":"trend micro apex one"},{"vendor":"trend micro","product":"trend micro officescan"},{"vendor":"trendmicro","product":"apex_one"},{"vendor":"trendmicro","product":"officescan"}],"references":[{"url":"https://success.trendmicro.com/solution/000281949","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://success.trendmicro.com/solution/000281947","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-20-1376/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28577"},{"url":"https://github.com/advisories/GHSA-2cqx-cjpv-4c7m"}],"sources":{"cve":[{"id":"CVE-2020-28577","description":"An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names.","status":"published","published":"2020-12-01T18:40:38Z","modified":"2024-08-04T16:40:59.382Z","updated_at":"2026-11-02T14:35:57.017407Z"}],"euvd":[{"id":"EUVD-2020-20975","description":"An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names.","status":"published","published":"2020-12-01T18:40:38Z","modified":"2024-08-04T16:40:59Z","updated_at":"2026-11-03T03:07:09.169254Z"}],"ghsa":[{"id":"GHSA-2cqx-cjpv-4c7m","title":"An improper access control information disclosure vulnerability in Trend Micro Apex One and...","description":"An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names.","status":"published","published":"2022-05-24T17:35:13Z","modified":"2023-01-29T05:04:49Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:45:38.830072Z"}],"nvd":[{"id":"CVE-2020-28577","description":"An improper access control information disclosure vulnerability in Trend Micro Apex One and OfficeScan XG SP1 could allow an unauthenticated user to connect to the product server and reveal server hostname and db names.","status":"published","published":"2020-12-01T19:15:12.603Z","modified":"2026-06-17T03:10:33.763Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:25.394006Z"}]}}