CVE-2017-6340: XSS
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field, which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally, IWSVA implements incorrect access control that allows any authenticated, remote user (even with low privileges like 'Auditor') to create or modify reports, and consequently take advantage of this XSS vulnerability. The JavaScript is executed when victims visit reports or auditlog pages.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6340?
CVE-2017-6340 has a medium severity rating due to improper input validation and access control vulnerabilities.
How do I fix CVE-2017-6340?
To fix CVE-2017-6340, you should update to Trend Micro InterScan Web Security Virtual Appliance 6.5 with CP 1746 or later versions.
What are the risks associated with CVE-2017-6340?
The risks associated with CVE-2017-6340 include potential JavaScript injection by unauthorized users, leading to data breaches or manipulation.
Who is affected by CVE-2017-6340?
CVE-2017-6340 affects users of Trend Micro InterScan Web Security Virtual Appliance version 6.5 and earlier without the CP 1746 patch.
Is CVE-2017-6340 public knowledge?
Yes, CVE-2017-6340 is publicly documented and can be referenced through various security vulnerability databases.