Lucene search

TrendmicroCVE-2018-10350

HistoryMay 25, 2018 - 3:29 p.m.

CVE-2018-10350

2018-05-2515:29:00

CWE-89

trendmicro

web.nvd.nist.gov

cve-2018-10350

sql injection

remote code execution

trend micro

smart protection server

nvd

vulnerability

authentication

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.008

Percentile

82.1%

JSON

A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw within the handling of parameters provided to wcs_bwlists_handler.php. Authentication is required in order to exploit this vulnerability.

Affected configurations

Nvd

Node

trendmicrosmart_protection_serverMatch3.0

trendmicrosmart_protection_serverMatch3.1

trendmicrosmart_protection_serverMatch3.2

trendmicrosmart_protection_serverMatch3.3

AND

linuxlinux_kernelMatch-

VendorProductVersionCPE
trendmicrosmart_protection_server3.0cpe:2.3:a:trendmicro:smart_protection_server:3.0:*:*:*:*:*:*:*
trendmicrosmart_protection_server3.1cpe:2.3:a:trendmicro:smart_protection_server:3.1:*:*:*:*:*:*:*
trendmicrosmart_protection_server3.2cpe:2.3:a:trendmicro:smart_protection_server:3.2:*:*:*:*:*:*:*
trendmicrosmart_protection_server3.3cpe:2.3:a:trendmicro:smart_protection_server:3.3:*:*:*:*:*:*:*
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	smart_protection_server	3.0	cpe:2.3:a:trendmicro:smart_protection_server:3.0:::::::*
trendmicro	smart_protection_server	3.1	cpe:2.3:a:trendmicro:smart_protection_server:3.1:::::::*
trendmicro	smart_protection_server	3.2	cpe:2.3:a:trendmicro:smart_protection_server:3.2:::::::*
trendmicro	smart_protection_server	3.3	cpe:2.3:a:trendmicro:smart_protection_server:3.3:::::::*
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*

CNA Affected

[
  {
    "product": "Trend Micro Smart Protection Server (Standalone)",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "3.0, 3.1, 3.2, 3.3"
      }
    ]
  }
]

References

success.trendmicro.com/solution/1119715

www.zerodayinitiative.com/advisories/ZDI-18-421/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.008

Percentile

82.1%

JSON

Related for CVE-2018-10350