Command injection

2017-08-0315:29:00

PRIOn knowledge base

www.prio-n.com

9.1 High

AI Score

Confidence

High

0.153 Low

EPSS

Percentile

95.9%

JSON

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the “t” parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.

CPENameOperatorVersion
interscan_messaging_security_virtual_applianceeq9.0
interscan_messaging_security_virtual_applianceeq9.1

CPE	Name	Operator	Version
	interscan_messaging_security_virtual_appliance	eq	9.0
	interscan_messaging_security_virtual_appliance	eq	9.1

References

www.securityfocus.com/bid/100075

www.zerodayinitiative.com/advisories/ZDI-17-502

success.trendmicro.com/solution/1117723