CVE-2017-11398
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.20%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 8.20% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-285, CWE-534
- Affected
- trendmicro/smart protection server
- Source
- security@trendmicro.com
References
- http://www.securityfocus.com/bid/102275Third Party Advisory, VDB Entry
- https://success.trendmicro.com/solution/1118992Vendor Advisory
- https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilitiesExploit, Third Party Advisory
- https://www.exploit-db.com/exploits/43388/Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/102275Third Party Advisory, VDB Entry
- https://success.trendmicro.com/solution/1118992Vendor Advisory
- https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilitiesExploit, Third Party Advisory
- https://www.exploit-db.com/exploits/43388/Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.