CVE-2017-11391

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.

Score

CVSS 3.0 8.8 High

Status

Modified - security@trendmicro.com

Published

2017-08-03

Last modified

2024-09-17

Weaknesses

CWE-77

Affected products

• Trend Micro Interscan Messaging Security Virtual Appliance (Trend Micro)
• Interscan Messaging Security Virtual Appliance (Trendmicro)

References

• http://www.securityfocus.com/bid/100075
• http://www.zerodayinitiative.com/advisories/ZDI-17-502
• https://success.trendmicro.com/solution/1117723