8.8
CVE-2017-11398
- EPSS 8.98%
- Veröffentlicht 19.01.2018 19:29:00
- Zuletzt bearbeitet 21.11.2024 03:07:42
- Quelle security@trendmicro.com
- Teams Watchlist Login
- Unerledigt Login
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Trendmicro ≫ Smart Protection Server Version <= 3.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 8.98% | 0.922 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 6.8 | 8.6 | 6.4 |
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
CWE-285 Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-534 DEPRECATED: Information Exposure Through Debug Log Files
This entry has been deprecated because its abstraction was too low-level. See CWE-532.