CVE-2018-10350

high · 8.8

A SQL injection remote code execution vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw within the handling of parameters provided to wcs\_bwlists\_handler.php. Authentication is required in order to exploit this vulnerability.

8.8

CVSS

14.7%

EPSS (exploit prob.)

97th

EPSS percentile

2018-05-25

Published

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
trendmicro	smart_protection_server	3.0
trendmicro	smart_protection_server	3.1
trendmicro	smart_protection_server	3.2
trendmicro	smart_protection_server	3.3
linux	linux_kernel	all versions

Check a specific version with /api/v1/cve/match.

References

https://success.trendmicro.com/solution/1119715
https://www.zerodayinitiative.com/advisories/ZDI-18-421/
https://success.trendmicro.com/solution/1119715
https://www.zerodayinitiative.com/advisories/ZDI-18-421/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-10350