CVE-2017-11398

Опубликовано: 19 янв. 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.

Ссылки

http://www.securityfocus.com/bid/102275
Third Party Advisory
VDB Entry
https://success.trendmicro.com/solution/1118992
Vendor Advisory
https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/43388/
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/102275
Third Party Advisory
VDB Entry
https://success.trendmicro.com/solution/1118992
Vendor Advisory
https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/43388/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:trendmicro:smart_protection_server:*:*:*:*:*:*:*:*

Версия до 3.2 (включая)

EPSS

Процентиль: 92%

0.08976

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-285

CWE-534

Связанные уязвимости

GHSA-gw2x-h452-c92v