CVE-2017-11398

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.

Score

CVSS 3.0 8.8 High

Status

Modified - security@trendmicro.com

Published

2018-01-19

Last modified

2024-08-05

Weaknesses

CWE-285, CWE-534

Affected products

• Trend Micro Smart Protection Server Standalone (Trend Micro)
• Smart Protection Server (Trendmicro)

References

• http://www.securityfocus.com/bid/102275
• https://success.trendmicro.com/solution/1118992
• https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
• https://www.exploit-db.com/exploits/43388/