Lucene search

TrendmicroCVELIST:CVE-2024-36359

HistoryJun 10, 2024 - 9:21 p.m.

CVE-2024-36359

2024-06-1021:21:59

trendmicro

www.cve.org

cross-site scripting

trend micro

iwsva

privilege escalation

low-privileged code execution

cve-2024-36359

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

16.2%

JSON

A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could allow an attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CNA Affected

[
  {
    "vendor": "Trend Micro, Inc.",
    "product": "Trend Micro InterScan Web Security Virtual Appliance",
    "versions": [
      {
        "version": "6.5",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "6.5 Build 3334"
      }
    ]
  }
]

References

success.trendmicro.com/dcx/s/solution/000298065

www.zerodayinitiative.com/advisories/ZDI-24-574/