CVE-2017-9033
Trend Micro ServerProtect Disclosure / CSRF / XSS
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoption_set.cgi, related to the lack of anti-CSRF tokens.
Una vulnerabilidad de tipo cross-site request forgery (CSRF) en ServerProtect de Trend Micro para Linux versión 3.0 anterior a CP 1531, permite a los atacantes remotos secuestrar la autenticación de los usuarios para solicitudes de inicio de una actualización desde una fuente arbitraria por medio de una petición diseñada para el archivo SProtectLinux/scanoption_set.cgi, relacionada a la falta de tokens anti-CSRF.
Trend Micro ServerProtect suffers from information disclosure, manipulation, cross site request forgery, cross site scripting, and various other vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-05-17 CVE Reserved
- 2017-05-24 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-352: Cross-Site Request Forgery (CSRF)
CAPEC
References (5)
URL | Tag | Source |
---|---|---|
http://www.securitytracker.com/id/1038548 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://success.trendmicro.com/solution/1117411 | 2021-09-09 |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Trendmicro Search vendor "Trendmicro" | Serverprotect Search vendor "Trendmicro" for product "Serverprotect" | 3.0 Search vendor "Trendmicro" for product "Serverprotect" and version "3.0" | linux |
Affected
|