CVE-2017-11398
First published: Fri Jan 19 2018(Updated: )
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.
Credit: security@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Trend Micro Smart Protection Server | <=3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-11398?
CVE-2017-11398 is a high severity vulnerability that allows session hijacking through log disclosure.
How do I fix CVE-2017-11398?
To fix CVE-2017-11398, upgrade to Trend Micro Smart Protection Server version 3.3 or later.
Who is affected by CVE-2017-11398?
CVE-2017-11398 affects users of Trend Micro Smart Protection Server versions 3.2 and below.
What type of attacks are possible with CVE-2017-11398?
CVE-2017-11398 allows unauthenticated attackers to hijack active user sessions and perform authenticated actions.
Is there a workaround for CVE-2017-11398?
There are no specific workarounds documented for CVE-2017-11398; upgrading is recommended.
- agent/severity
- agent/references
- agent/event
- agent/type
- agent/weakness
- agent/author
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/trendmicro
- canonical/trend micro smart protection server
- version/trend micro smart protection server/3.2