PT-2017-11976 · Trend Micro · Trend Micro Control Manager

Published 2017-07-31 · Updated 2017-08-04 · CVE-2017-11390

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Control Manager version 6.0

Description The issue is related to XML external entity (XXE) processing, which could lead to information disclosure if exploited.

Recommendations For Trend Micro Control Manager version 6.0, update to a version that fixes the XML external entity processing vulnerability to prevent information disclosure.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-11390

ZDI-17-501

Affected Products

Trend Micro Control Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-11390 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11390 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-501 · Security Note
• https://success.trendmicro.com/solution/1117722 · Vendor Advisory
• http://securityfocus.com/bid/100078 · Note
• http://zerodayinitiative.com/advisories/ZDI-17-501 · Note