PT-2017-17007 · Trend Micro · Trend Micro Interscan Web Security Virtual Appliance

Published 2017-04-05 · Updated 2017-04-11 · CVE-2017-6340

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro InterScan Web Security Virtual Appliance (IWSVA) versions 6.5 before CP 1746

Description The issue concerns a lack of sanitization in a report/template name field, allowing a user with 'Reports Only' access to inject malicious JavaScript when creating a new report. Furthermore, incorrect access control allows any authenticated, remote user, including those with low privileges like 'Auditor', to create or modify reports and exploit this issue. The injected JavaScript is executed when victims visit reports or audit log pages.

Recommendations For Trend Micro InterScan Web Security Virtual Appliance (IWSVA) versions 6.5 before CP 1746, update to a version that includes CP 1746 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-6340

Affected Products

Trend Micro Interscan Web Security Virtual Appliance

References · 6

• 🔥 https://exploit-db.com/exploits/42013 · Exploit
• 🔥 https://qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-6340 · Security Note
• https://success.trendmicro.com/solution/1116960 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6340 · Vendor Advisory
• http://securityfocus.com/bid/97487 · Note