CVE-2017-6338

Multiple Access Control issues in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 allow an authenticated, remote user with low privileges like 'Reports Only' or 'Auditor' to change FTP Access Control Settings, create or modify reports, or upload an HTTPS Decryption Certificate and Private Key.

Score

CVSS 3.0 6.5 Medium

Status

Modified - cve@mitre.org

Published

2017-04-05

Last modified

2024-08-05

Weaknesses

CWE-732

Affected products

• Interscan Web Security Virtual Appliance (Trendmicro)

References

• http://www.securityfocus.com/bid/97482
• https://success.trendmicro.com/solution/1116960
• https://www.qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdf