CVE-2015-2872: XSS

Published Aug 23, 2015

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web script or HTML via (1) crafted input to index.php that is processed by certain Internet Explorer 7 configurations or (2) crafted input to the widget feature.

Affected Software

9 affected components

trendmicro Deep Discovery Inspector=3.5

trendmicro Deep Discovery Inspector=3.6

trendmicro Deep Discovery Inspector=3.7

trendmicro Deep Discovery Inspector=3.8

Remediation

Patch Available

http://esupport.trendmicro.com/solution/en-US/1112206.aspx

Event History

Aug 23, 2015

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What are the implications of CVE-2015-2872?

CVE-2015-2872 presents multiple cross-site scripting (XSS) vulnerabilities that can allow remote attackers to inject arbitrary web scripts.

Which versions of Trend Micro Deep Discovery Inspector are affected by CVE-2015-2872?

CVE-2015-2872 affects Trend Micro Deep Discovery Inspector versions prior to 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other lower versions.

How do I remediate CVE-2015-2872?

Remediation for CVE-2015-2872 involves upgrading to Trend Micro Deep Discovery Inspector versions 3.5.1477, 3.6.1217, 3.7.1248, 3.8.1263 or later.

What types of attacks can CVE-2015-2872 facilitate?

CVE-2015-2872 can facilitate attacks such as stealing user credentials or executing malicious scripts in a user's browser.

Who is primarily affected by CVE-2015-2872?

Organizations using vulnerable versions of Trend Micro Deep Discovery Inspector are primarily affected by the risks associated with CVE-2015-2872.