CVE-2018-10350

Опубликовано: 25 мая 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Средний

Описание

A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw within the handling of parameters provided to wcs_bwlists_handler.php. Authentication is required in order to exploit this vulnerability.

Ссылки

https://success.trendmicro.com/solution/1119715
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-18-421/
Third Party Advisory
VDB Entry
https://success.trendmicro.com/solution/1119715
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-18-421/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:trendmicro:smart_protection_server:3.0:*:*:*:*:*:*:*

cpe:2.3:a:trendmicro:smart_protection_server:3.1:*:*:*:*:*:*:*

cpe:2.3:a:trendmicro:smart_protection_server:3.2:*:*:*:*:*:*:*

cpe:2.3:a:trendmicro:smart_protection_server:3.3:*:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

EPSS

Процентиль: 97%

0.41412

Средний

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-462f-w779-v664