High severity · published Mar 14, 2017
CVE-2017-6398
An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600
8.8
CVSS
54.1%
EPSS
No
On KEV
Description
An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a terminal command in the context of the web server user (which is root). Besides, the default installation of IMSVA comes with default administrator credentials. The saveCert.imss endpoint takes several user inputs and performs blacklisting. After that, it uses them as arguments to a predefined operating-system command without proper sanitization. However, because of an improper blacklisting rule, it's possible to inject arbitrary commands into it.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)54.1% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Interscan Messaging Security Virtual Appliance · Trendmicro
9.1-1600 · source: NVD
Affected product
IM
Interscan Messaging Security Virtual Appliance
Trendmicro
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-6398
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-6398
www.securityfocus.com
http://www.securityfocus.com/bid/96859
Third Party Advisory
https://www.rapid7.com/db/modules/exploit/linux/http/trend_micro_imsva_exec
More from Interscan Messaging Security Virtual Appliance
8.8
CVE-2020-27694
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 has updated a specific critical library that may vulnerable to attack
8.8
CVE-2020-27016
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to a cross-site request forgery (CSRF) vulnerability which could allow an attacker to modify…
8.8
CVE-2017-11392
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable…
8.8
CVE-2017-11391
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable…
8.1
CVE-2018-3609
A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access sensitive information…