PT-2017-10053 · Trend Micro · Trend Micro Interscan Web Security Virtual Appliance

Published 2017-02-21 · Updated 2017-07-25 · CVE-2016-9316

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance (IWSVA) versions prior to 6.5 CP 1737

Description The issue allows authenticated, remote users with least privileges to inject arbitrary HTML/JavaScript code into web pages due to multiple stored Cross-Site-Scripting (XSS) vulnerabilities in the com.trend.iwss.gui.servlet.updateaccountadministration component.

Recommendations For versions prior to 6.5 CP 1737, update to version 6.5 CP 1737 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2016-9316

Affected Products

Trend Micro Interscan Web Security Virtual Appliance

References · 6

• 🔥 https://exploit-db.com/exploits/41361 · Exploit
• https://success.trendmicro.com/solution/1116672 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-9316 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9316 · Security Note
• http://securityfocus.com/bid/96252 · Note
• http://securitytracker.com/id/1037849 · Note