Input validation error in InterScan Web Security Virtual Appliance (IWSVA) - CVE-2017-11396
Published: September 22, 2017 / Updated: August 21, 2020
Vulnerability identifier: #VU45890
CSH Severity: Medium
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-11396
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to execute arbitrary code.
Vulnerability issues with the web service inspection of input parameters in Trend Micro Web Security Virtual Appliance 6.5 may allow potential attackers who already have administration rights to the console to implement remote code injections.
Affected software
InterScan Web Security Virtual Appliance (IWSVA)
How to mitigate CVE-2017-11396
Install update from vendor's website.