InterScan Web Security Virtual Appliance vulnerable to code injection


InterScan Web Security Virtual Appliance provided by Trend Micro Incorporated contains code injection vulnerability.
CVSS Severity (What is CVSS?)

Base Metrics: 9.0 (High) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Low
  • Authentication: Single Instance
  • Confidentiality Impact: Complete
  • Integrity Impact: Complete
  • Availability Impact: Complete

CVSS V3 Severity:
Base Metrics: 7.2 (High) [IPA Score]
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High
Affected Products

Trend Micro, Inc.
  • TrendMicro InterScan Web Security Virtual Appliance 6.5 and earlier

Please refer to the vendor information for more details.

Arbitrary code may be executed by a user who logged-in to the management screen of the product as an administrator.

[Apply the Patch]
Apply the patch according to the information provided by the developer.
Vendor Information

Trend Micro, Inc.
CWE (What is CWE?)

CVE (What is CVE?)

  1. CVE-2017-11396

  1. JVN : JVNVU#90447827
Revision History

  Web page was published