VulnerabilityModified

CVE-2012-2998

SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

HIGH 7.5EPSS 6.09%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (6.09%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 6.09% probability · 93th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: trend micro/control manager
Source: cret@cert.org

References

http://esupport.trendmicro.com/solution/en-us/1061043.aspxVendor Advisory
http://jvn.jp/en/jp/JVN42014489/index.htmlPatch
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000090Patch
http://www.kb.cert.org/vuls/id/950795US Government Resource
http://www.securitytracker.com/id?1027584
http://www.spentera.com/2012/09/trend-micro-control-manager-sql-injection-vulnerability/Patch
http://www.trendmicro.com/ftp/documentation/readme/readme_critical_patch_TMCM55_1823.txtPatch
http://www.trendmicro.com/ftp/documentation/readme/readme_critical_patch_tmcm60_patch1_1449.txtPatch
http://esupport.trendmicro.com/solution/en-us/1061043.aspxVendor Advisory
http://jvn.jp/en/jp/JVN42014489/index.htmlPatch
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000090Patch
http://www.kb.cert.org/vuls/id/950795US Government Resource
http://www.securitytracker.com/id?1027584
http://www.spentera.com/2012/09/trend-micro-control-manager-sql-injection-vulnerability/Patch
http://www.trendmicro.com/ftp/documentation/readme/readme_critical_patch_TMCM55_1823.txtPatch
http://www.trendmicro.com/ftp/documentation/readme/readme_critical_patch_tmcm60_patch1_1449.txtPatch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.