jwoytek-cisa
commented
2 weeks ago @j-baines thanks for identifying this issue! I'm going to accept this PR but wanted to let you know about what you're going to see once the upstream changes to this record sync out everywhere:
- The NVD CPE dictionary has a specific entry for version 2019, which Trend Micro calls out as the product version. We have retained that CPE entry.
- We updated the version range to show 14 as the lower bound, as you suggested.
- We noted that there is a specific CPE in the NVD dictionary for the SAAS product, and updated to that CPE with 14 as the lower bound as well. Confusingly, there is also an entry for the SAAS product and version 2019, but none of the Trend docs seem to call out the SAAS product as version 2019, so we stuck with the generic version entry for that and filled in the range.
Vendor reports the affected range oddly, but they clearly intended the lower bound to be 14.0 since "2019" doesn't make any sense.