PT-2017-10053 · Trend Micro · Trend Micro Interscan Web Security Virtual Appliance

Publicado 2017-02-21 · Atualizado 2017-07-25 · CVE-2016-9316

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance (IWSVA) versions prior to 6.5 CP 1737

Description The issue allows authenticated, remote users with least privileges to inject arbitrary HTML/JavaScript code into web pages due to multiple stored Cross-Site-Scripting (XSS) vulnerabilities in the com.trend.iwss.gui.servlet.updateaccountadministration component.

Recommendations For versions prior to 6.5 CP 1737, update to version 6.5 CP 1737 to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2016-9316

Produtos afetados

Trend Micro Interscan Web Security Virtual Appliance

Referências · 6

• 🔥 https://exploit-db.com/exploits/41361 · Exploit
• http://securityfocus.com/bid/96252 · Nota
• https://success.trendmicro.com/solution/1116672 · Aviso do Fabricante
• http://securitytracker.com/id/1037849 · Nota
• https://osv.dev/vulnerability/CVE-2016-9316 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-9316 · Nota de Segurança