CVE-2016-5840: Input Validation
First published: Thu Jun 30 2016(Updated: )
hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7, 3.8 SP1 (3.81), and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trend Micro Deep Discovery Email Inspector | =3.7 | |
| Trend Micro Deep Discovery Email Inspector | =3.81 | |
| Trend Micro Deep Discovery Email Inspector | =3.82 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-5840?
CVE-2016-5840 has a high severity rating due to its potential to allow remote code execution.
How do I fix CVE-2016-5840?
You can fix CVE-2016-5840 by updating to the latest version of Trend Micro Deep Discovery Inspector that addresses this vulnerability.
What versions of Trend Micro Deep Discovery Inspector are affected by CVE-2016-5840?
CVE-2016-5840 affects Trend Micro Deep Discovery Inspector versions 3.7, 3.8 SP1, and 3.8 SP2.
What type of attack is facilitated by CVE-2016-5840?
CVE-2016-5840 facilitates remote code execution attacks through shell metacharacters in crafted requests.
Who can exploit CVE-2016-5840?
Remote administrators with access to the system can potentially exploit CVE-2016-5840 to execute arbitrary code.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/references
- agent/author
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/trend micro
- canonical/trend micro deep discovery email inspector
- version/trend micro deep discovery email inspector/3.7
- version/trend micro deep discovery email inspector/3.81
- version/trend micro deep discovery email inspector/3.82