CVE-2017-11393: Command Injection
First published: Thu Aug 03 2017(Updated: )
Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the tr parameter within Proxy.php. Formerly ZDI-CAN-4543.
Credit: security@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trend Micro OfficeScan Corporate Edition | =11.0-sp1 | |
| Trend Micro OfficeScan Corporate Edition | =12.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-11393?
CVE-2017-11393 has been assigned a high severity rating due to its ability to allow remote code execution.
How do I fix CVE-2017-11393?
To fix CVE-2017-11393, it is recommended to apply the latest security patches provided by Trend Micro for OfficeScan.
What systems are impacted by CVE-2017-11393?
CVE-2017-11393 affects Trend Micro OfficeScan version 11.0 SP1 and version 12.0.
Is CVE-2017-11393 being actively exploited?
There have been reports that CVE-2017-11393 is being actively exploited in the wild.
What are the potential consequences of CVE-2017-11393?
Exploitation of CVE-2017-11393 could lead to unauthorized access and execution of arbitrary code on vulnerable installations.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/references
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/trendmicro
- canonical/trend micro officescan corporate edition
- version/trend micro officescan corporate edition/11.0-sp1
- version/trend micro officescan corporate edition/12.0