CVE-2017-11394: Input Validation
Published Aug 3, 2017
·Updated
Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544.
Affected Software
2 affected components
trendmicro Officescan=11.0-sp1
trendmicro Officescan=12.0
Remediation
Patch Available
Event History
Aug 3, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-11394?
CVE-2017-11394 is considered a high severity vulnerability due to its potential for arbitrary code execution.
2
How do I fix CVE-2017-11394?
To fix CVE-2017-11394, update Trend Micro OfficeScan to the latest version that patches this vulnerability.
3
Which versions of Trend Micro OfficeScan are affected by CVE-2017-11394?
CVE-2017-11394 affects Trend Micro OfficeScan versions 11.0-sp1 and 12.0.
4
What type of vulnerability is CVE-2017-11394?
CVE-2017-11394 is a proxy command injection vulnerability that can allow remote code execution.
5
Who can exploit CVE-2017-11394?
Remote attackers can exploit CVE-2017-11394 to execute arbitrary code on vulnerable installations.