CVE-2017-11398
19.01.2018, 19:29
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.Enginsight
| Vendor | Product | Version |
|---|---|---|
| trendmicro | smart_protection_server | 𝑥 ≤ 3.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-285 - Improper AuthorizationThe software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-534 - DEPRECATED: Information Exposure Through Debug Log FilesThis entry has been deprecated because its abstraction was too low-level. See CWE-532.