PT-2017-11973 · Trend Micro · Trend Micro Control Manager

Published 2017-07-31 · Updated 2017-08-06 · CVE-2017-11387

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Control Manager version 6.0

Description The issue allows for authentication bypass, leading to information disclosure. This occurs because authentication validation is not properly performed for certain functionality, specifically the ability to change the debug logging level.

Recommendations For Trend Micro Control Manager version 6.0, consider restricting access to the functionality that allows changing the debug logging level until a fix is available. As a temporary workaround, disabling the ability to modify debug logging levels can help minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-11387

ZDI-17-497

Affected Products

Trend Micro Control Manager

References · 7

• https://osv.dev/vulnerability/CVE-2017-11387 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11387 · Security Note
• https://success.trendmicro.com/solution/1117722 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-497 · Security Note
• http://securityfocus.com/bid/100078 · Note
• http://securitytracker.com/id/1039049 · Note
• http://zerodayinitiative.com/advisories/ZDI-17-497 · Note