PT-2017-11973 · Trend Micro · Trend Micro Control Manager

Publicado 2017-07-31 · Atualizado 2017-08-06 · CVE-2017-11387

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Control Manager version 6.0

Description The issue allows for authentication bypass, leading to information disclosure. This occurs because authentication validation is not properly performed for certain functionality, specifically the ability to change the debug logging level.

Recommendations For Trend Micro Control Manager version 6.0, consider restricting access to the functionality that allows changing the debug logging level until a fix is available. As a temporary workaround, disabling the ability to modify debug logging levels can help minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-11387

ZDI-17-497

Produtos afetados

Trend Micro Control Manager

Referências · 7

• https://osv.dev/vulnerability/CVE-2017-11387 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11387 · Nota de Segurança
• http://securityfocus.com/bid/100078 · Nota
• http://securitytracker.com/id/1039049 · Nota
• https://success.trendmicro.com/solution/1117722 · Aviso do Fabricante
• http://zerodayinitiative.com/advisories/ZDI-17-497 · Nota
• https://zerodayinitiative.com/advisories/ZDI-17-497 · Nota de Segurança