Search
Find a vulnerability
Search criteria
6 vulnerabilities found for Trend Micro InterScan Messaging Security Virtual Appliance by Trend Micro
CVE-2018-3609 (GCVE-0-2018-3609)
Vulnerability from nvd – Published: 2018-02-16 22:00 – Updated: 2024-08-05 04:50
VLAI
Summary
A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations.
Severity
No CVSS data available.
CWE
- CWE-522 - Insufficiently Protected Credentials (CWE-522)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://korelogic.com/Resources/Advisories/KL-001… | x_refsource_MISC |
| https://success.trendmicro.com/solution/1119277 | x_refsource_CONFIRM |
| https://success.trendmicro.com/jp/solution/1119290 | x_refsource_MISC |
| http://www.securityfocus.com/bid/103097 | vdb-entryx_refsource_BID |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Trend Micro | Trend Micro InterScan Messaging Security Virtual Appliance |
Affected:
9.0 and 9.1
|
Date Public
2018-02-16 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T04:50:30.385Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://success.trendmicro.com/solution/1119277"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://success.trendmicro.com/jp/solution/1119290"
},
{
"name": "103097",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/103097"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Trend Micro InterScan Messaging Security Virtual Appliance",
"vendor": "Trend Micro",
"versions": [
{
"status": "affected",
"version": "9.0 and 9.1"
}
]
}
],
"datePublic": "2018-02-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials (CWE-522)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-02-22T10:57:01.000Z",
"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"shortName": "trendmicro"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://success.trendmicro.com/solution/1119277"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://success.trendmicro.com/jp/solution/1119290"
},
{
"name": "103097",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/103097"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@trendmicro.com",
"ID": "CVE-2018-3609",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Trend Micro InterScan Messaging Security Virtual Appliance",
"version": {
"version_data": [
{
"version_value": "9.0 and 9.1"
}
]
}
}
]
},
"vendor_name": "Trend Micro"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Insufficiently Protected Credentials (CWE-522)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt",
"refsource": "MISC",
"url": "https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt"
},
{
"name": "https://success.trendmicro.com/solution/1119277",
"refsource": "CONFIRM",
"url": "https://success.trendmicro.com/solution/1119277"
},
{
"name": "https://success.trendmicro.com/jp/solution/1119290",
"refsource": "MISC",
"url": "https://success.trendmicro.com/jp/solution/1119290"
},
{
"name": "103097",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/103097"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"assignerShortName": "trendmicro",
"cveId": "CVE-2018-3609",
"datePublished": "2018-02-16T22:00:00.000Z",
"dateReserved": "2017-12-27T00:00:00.000Z",
"dateUpdated": "2024-08-05T04:50:30.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-11392 (GCVE-0-2017-11392)
Vulnerability from nvd – Published: 2017-08-03 15:00 – Updated: 2024-09-17 04:08
VLAI
Summary
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.
Severity
No CVSS data available.
CWE
- Proxy Command Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/100075 | vdb-entryx_refsource_BID |
| https://success.trendmicro.com/solution/1117723 | x_refsource_MISC |
| http://www.zerodayinitiative.com/advisories/ZDI-17-504 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Trend Micro | Trend Micro InterScan Messaging Security Virtual Appliance |
Affected:
9.0,9.1
|
Date Public
2017-07-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T18:05:30.577Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "100075",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/100075"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-504"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Trend Micro InterScan Messaging Security Virtual Appliance",
"vendor": "Trend Micro",
"versions": [
{
"status": "affected",
"version": "9.0,9.1"
}
]
}
],
"datePublic": "2017-07-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the \"T\" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Proxy Command Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-04T09:57:01.000Z",
"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"shortName": "trendmicro"
},
"references": [
{
"name": "100075",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/100075"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-504"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@trendmicro.com",
"DATE_PUBLIC": "2017-07-20T00:00:00",
"ID": "CVE-2017-11392",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Trend Micro InterScan Messaging Security Virtual Appliance",
"version": {
"version_data": [
{
"version_value": "9.0,9.1"
}
]
}
}
]
},
"vendor_name": "Trend Micro"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the \"T\" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Proxy Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "100075",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/100075"
},
{
"name": "https://success.trendmicro.com/solution/1117723",
"refsource": "MISC",
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"name": "http://www.zerodayinitiative.com/advisories/ZDI-17-504",
"refsource": "MISC",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-504"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"assignerShortName": "trendmicro",
"cveId": "CVE-2017-11392",
"datePublished": "2017-08-03T15:00:00.000Z",
"dateReserved": "2017-07-17T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:08:45.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-11391 (GCVE-0-2017-11391)
Vulnerability from nvd – Published: 2017-08-03 15:00 – Updated: 2024-09-17 03:33
VLAI
Summary
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.
Severity
No CVSS data available.
CWE
- Proxy Command Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/100075 | vdb-entryx_refsource_BID |
| https://success.trendmicro.com/solution/1117723 | x_refsource_MISC |
| http://www.zerodayinitiative.com/advisories/ZDI-17-502 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Trend Micro | Trend Micro InterScan Messaging Security Virtual Appliance |
Affected:
9.0,9.1
|
Date Public
2017-07-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T18:05:30.490Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "100075",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/100075"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-502"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Trend Micro InterScan Messaging Security Virtual Appliance",
"vendor": "Trend Micro",
"versions": [
{
"status": "affected",
"version": "9.0,9.1"
}
]
}
],
"datePublic": "2017-07-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the \"t\" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Proxy Command Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-04T09:57:01.000Z",
"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"shortName": "trendmicro"
},
"references": [
{
"name": "100075",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/100075"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-502"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@trendmicro.com",
"DATE_PUBLIC": "2017-07-20T00:00:00",
"ID": "CVE-2017-11391",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Trend Micro InterScan Messaging Security Virtual Appliance",
"version": {
"version_data": [
{
"version_value": "9.0,9.1"
}
]
}
}
]
},
"vendor_name": "Trend Micro"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the \"t\" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Proxy Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "100075",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/100075"
},
{
"name": "https://success.trendmicro.com/solution/1117723",
"refsource": "MISC",
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"name": "http://www.zerodayinitiative.com/advisories/ZDI-17-502",
"refsource": "MISC",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-502"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"assignerShortName": "trendmicro",
"cveId": "CVE-2017-11391",
"datePublished": "2017-08-03T15:00:00.000Z",
"dateReserved": "2017-07-17T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:33:52.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-3609 (GCVE-0-2018-3609)
Vulnerability from cvelistv5 – Published: 2018-02-16 22:00 – Updated: 2024-08-05 04:50
VLAI
Summary
A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations.
Severity
No CVSS data available.
CWE
- CWE-522 - Insufficiently Protected Credentials (CWE-522)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://korelogic.com/Resources/Advisories/KL-001… | x_refsource_MISC |
| https://success.trendmicro.com/solution/1119277 | x_refsource_CONFIRM |
| https://success.trendmicro.com/jp/solution/1119290 | x_refsource_MISC |
| http://www.securityfocus.com/bid/103097 | vdb-entryx_refsource_BID |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Trend Micro | Trend Micro InterScan Messaging Security Virtual Appliance |
Affected:
9.0 and 9.1
|
Date Public
2018-02-16 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T04:50:30.385Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://success.trendmicro.com/solution/1119277"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://success.trendmicro.com/jp/solution/1119290"
},
{
"name": "103097",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/103097"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Trend Micro InterScan Messaging Security Virtual Appliance",
"vendor": "Trend Micro",
"versions": [
{
"status": "affected",
"version": "9.0 and 9.1"
}
]
}
],
"datePublic": "2018-02-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "Insufficiently Protected Credentials (CWE-522)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-02-22T10:57:01.000Z",
"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"shortName": "trendmicro"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://success.trendmicro.com/solution/1119277"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://success.trendmicro.com/jp/solution/1119290"
},
{
"name": "103097",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/103097"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@trendmicro.com",
"ID": "CVE-2018-3609",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Trend Micro InterScan Messaging Security Virtual Appliance",
"version": {
"version_data": [
{
"version_value": "9.0 and 9.1"
}
]
}
}
]
},
"vendor_name": "Trend Micro"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information in a particular log file that could be used to bypass authentication on vulnerable installations."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Insufficiently Protected Credentials (CWE-522)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt",
"refsource": "MISC",
"url": "https://korelogic.com/Resources/Advisories/KL-001-2018-006.txt"
},
{
"name": "https://success.trendmicro.com/solution/1119277",
"refsource": "CONFIRM",
"url": "https://success.trendmicro.com/solution/1119277"
},
{
"name": "https://success.trendmicro.com/jp/solution/1119290",
"refsource": "MISC",
"url": "https://success.trendmicro.com/jp/solution/1119290"
},
{
"name": "103097",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/103097"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"assignerShortName": "trendmicro",
"cveId": "CVE-2018-3609",
"datePublished": "2018-02-16T22:00:00.000Z",
"dateReserved": "2017-12-27T00:00:00.000Z",
"dateUpdated": "2024-08-05T04:50:30.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-11391 (GCVE-0-2017-11391)
Vulnerability from cvelistv5 – Published: 2017-08-03 15:00 – Updated: 2024-09-17 03:33
VLAI
Summary
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.
Severity
No CVSS data available.
CWE
- Proxy Command Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/100075 | vdb-entryx_refsource_BID |
| https://success.trendmicro.com/solution/1117723 | x_refsource_MISC |
| http://www.zerodayinitiative.com/advisories/ZDI-17-502 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Trend Micro | Trend Micro InterScan Messaging Security Virtual Appliance |
Affected:
9.0,9.1
|
Date Public
2017-07-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T18:05:30.490Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "100075",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/100075"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-502"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Trend Micro InterScan Messaging Security Virtual Appliance",
"vendor": "Trend Micro",
"versions": [
{
"status": "affected",
"version": "9.0,9.1"
}
]
}
],
"datePublic": "2017-07-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the \"t\" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Proxy Command Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-04T09:57:01.000Z",
"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"shortName": "trendmicro"
},
"references": [
{
"name": "100075",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/100075"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-502"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@trendmicro.com",
"DATE_PUBLIC": "2017-07-20T00:00:00",
"ID": "CVE-2017-11391",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Trend Micro InterScan Messaging Security Virtual Appliance",
"version": {
"version_data": [
{
"version_value": "9.0,9.1"
}
]
}
}
]
},
"vendor_name": "Trend Micro"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the \"t\" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Proxy Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "100075",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/100075"
},
{
"name": "https://success.trendmicro.com/solution/1117723",
"refsource": "MISC",
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"name": "http://www.zerodayinitiative.com/advisories/ZDI-17-502",
"refsource": "MISC",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-502"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"assignerShortName": "trendmicro",
"cveId": "CVE-2017-11391",
"datePublished": "2017-08-03T15:00:00.000Z",
"dateReserved": "2017-07-17T00:00:00.000Z",
"dateUpdated": "2024-09-17T03:33:52.729Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-11392 (GCVE-0-2017-11392)
Vulnerability from cvelistv5 – Published: 2017-08-03 15:00 – Updated: 2024-09-17 04:08
VLAI
Summary
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.
Severity
No CVSS data available.
CWE
- Proxy Command Injection
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/100075 | vdb-entryx_refsource_BID |
| https://success.trendmicro.com/solution/1117723 | x_refsource_MISC |
| http://www.zerodayinitiative.com/advisories/ZDI-17-504 | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Trend Micro | Trend Micro InterScan Messaging Security Virtual Appliance |
Affected:
9.0,9.1
|
Date Public
2017-07-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T18:05:30.577Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "100075",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/100075"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-504"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Trend Micro InterScan Messaging Security Virtual Appliance",
"vendor": "Trend Micro",
"versions": [
{
"status": "affected",
"version": "9.0,9.1"
}
]
}
],
"datePublic": "2017-07-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the \"T\" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Proxy Command Injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-04T09:57:01.000Z",
"orgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"shortName": "trendmicro"
},
"references": [
{
"name": "100075",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/100075"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-504"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@trendmicro.com",
"DATE_PUBLIC": "2017-07-20T00:00:00",
"ID": "CVE-2017-11392",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Trend Micro InterScan Messaging Security Virtual Appliance",
"version": {
"version_data": [
{
"version_value": "9.0,9.1"
}
]
}
}
]
},
"vendor_name": "Trend Micro"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the \"T\" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Proxy Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "100075",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/100075"
},
{
"name": "https://success.trendmicro.com/solution/1117723",
"refsource": "MISC",
"url": "https://success.trendmicro.com/solution/1117723"
},
{
"name": "http://www.zerodayinitiative.com/advisories/ZDI-17-504",
"refsource": "MISC",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-17-504"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7f7bd7df-cffe-4fdb-ab6d-859363b89272",
"assignerShortName": "trendmicro",
"cveId": "CVE-2017-11392",
"datePublished": "2017-08-03T15:00:00.000Z",
"dateReserved": "2017-07-17T00:00:00.000Z",
"dateUpdated": "2024-09-17T04:08:45.789Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}