Trellix System Information Reporter up to 1.0.3 ePO POST Request path traversal

Summaryinfo

A vulnerability categorized as critical has been discovered in Trellix System Information Reporter up to 1.0.3. Affected is an unknown function of the component ePO POST Request Handler. Executing a manipulation can lead to path traversal. This vulnerability is tracked as CVE-2025-3722. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Trellix System Information Reporter up to 1.0.3. It has been declared as critical. This vulnerability affects an unknown functionality of the component ePO POST Request Handler. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post requests to System Information Reporter, leading to creation of files anywhere on the filesystem and possibly overwriting existing files and exposing sensitive information disclosure.

The advisory is shared for download at thrive.trellix.com. This vulnerability was named CVE-2025-3722 since 04/16/2025. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1006.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Reporting Software

Vendor

• Trellix

Name

• System Information Reporter

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion