CVE-2017-11392

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "T" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
trendmicroCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
VendorProductVersion
trendmicrointerscan_messaging_security_virtual_appliance
9.0
trendmicrointerscan_messaging_security_virtual_appliance
9.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/100075
http://www.zerodayinitiative.com/advisories/ZDI-17-504
https://success.trendmicro.com/solution/1117723
http://www.securityfocus.com/bid/100075
http://www.zerodayinitiative.com/advisories/ZDI-17-504
https://success.trendmicro.com/solution/1117723