PT-2017-17007 · Trend Micro · Trend Micro Interscan Web Security Virtual Appliance

Publicado 2017-04-05 · Atualizado 2017-04-11 · CVE-2017-6340

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance (IWSVA) versions 6.5 before CP 1746

Description The issue concerns a lack of sanitization in a report/template name field, allowing a user with 'Reports Only' access to inject malicious JavaScript when creating a new report. Furthermore, incorrect access control allows any authenticated, remote user, including those with low privileges like 'Auditor', to create or modify reports and exploit this issue. The injected JavaScript is executed when victims visit reports or audit log pages.

Recommendations For Trend Micro InterScan Web Security Virtual Appliance (IWSVA) versions 6.5 before CP 1746, update to a version that includes CP 1746 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-6340

Produtos afetados

Trend Micro Interscan Web Security Virtual Appliance

Referências · 6

• 🔥 https://exploit-db.com/exploits/42013 · Exploit
• 🔥 https://qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-6340 · Nota de Segurança
• https://success.trendmicro.com/solution/1116960 · Aviso do Fabricante
• http://securityfocus.com/bid/97487 · Nota
• https://osv.dev/vulnerability/CVE-2017-6340 · Aviso do Fabricante