CVE-2017-11391

high · 8.8

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.

8.8

CVSS

61.8%

EPSS (exploit prob.)

99th

EPSS percentile

2017-08-03

Published

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-77

Affected products

Vendor	Product	Affected versions
trendmicro	interscan_messaging_security_virtual_appliance	9.0
trendmicro	interscan_messaging_security_virtual_appliance	9.1

Check a specific version with /api/v1/cve/match.

References

http://www.securityfocus.com/bid/100075
http://www.zerodayinitiative.com/advisories/ZDI-17-502
https://success.trendmicro.com/solution/1117723
http://www.securityfocus.com/bid/100075
http://www.zerodayinitiative.com/advisories/ZDI-17-502
https://success.trendmicro.com/solution/1117723

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-11391