CVE-2017-11398

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control2017-12-19 · remote · multiple

Impact

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://www.securityfocus.com/bid/102275
• https://success.trendmicro.com/solution/1118992
• https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
• https://www.exploit-db.com/exploits/43388/
• http://www.securityfocus.com/bid/102275
• https://success.trendmicro.com/solution/1118992
• https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
• https://www.exploit-db.com/exploits/43388/