VulnerabilityModified
CVE-2017-11388
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries.
HIGH 8.8EPSS 14.1%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 14.1%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries. Formerly ZDI-CAN-4639 and ZDI-CAN-4638.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 14.10% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- trendmicro/control manager
- Source
- security@trendmicro.com
References
- http://www.securityfocus.com/bid/100078
- http://www.securitytracker.com/id/1039049
- http://www.zerodayinitiative.com/advisories/ZDI-17-498Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-17-499Third Party Advisory, VDB Entry
- https://success.trendmicro.com/solution/1117722Patch, Vendor Advisory
- http://www.securityfocus.com/bid/100078
- http://www.securitytracker.com/id/1039049
- http://www.zerodayinitiative.com/advisories/ZDI-17-498Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-17-499Third Party Advisory, VDB Entry
- https://success.trendmicro.com/solution/1117722Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.