Lucene search

TrendmicroCVE-2018-15365

HistorySep 28, 2018 - 5:29 p.m.

CVE-2018-15365

2018-09-2817:29:00

CWE-79

trendmicro

web.nvd.nist.gov

cve-2018-15365

reflected cross-site scripting

xss vulnerability

trend micro deep discovery inspector

csrf protection

authenticated user

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.5%

JSON

A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability.

Affected configurations

Nvd

Node

trendmicrodeep_discovery_inspectorRange≤3.85

VendorProductVersionCPE
trendmicrodeep_discovery_inspector*cpe:2.3:a:trendmicro:deep_discovery_inspector:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	deep_discovery_inspector	*	cpe:2.3:a:trendmicro:deep_discovery_inspector::::::::

CNA Affected

[
  {
    "product": "Trend Micro Deep Discovery Inspector",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "3.85"
      }
    ]
  }
]

References

github.com/nixwizard/CVE-2018-15365/

success.trendmicro.com/solution/1121079

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

24.5%

JSON

Related for CVE-2018-15365