CVE-2024-11481 — Trellix / Trellix Enterprise Security Manager (ESM)

CVE-2024-11481

Trellix / Trellix Enterprise Security Manager (ESM) PUBLISHED

Description (CNA)

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints.

Affected (CNA)

Vendor / product	Versions
Trellix / Trellix Enterprise Security Manager (ESM)	affected 11.6.12

CWE

CWE-22

References

https://thrive.trellix.com/s/article/000014058

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.