CVE-2017-11398 - A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system

Back Back to CVE browser

HIGH

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system

Published Jan 19, 2018

8.8

HIGH

CVSS 3.0

EPSS 8.20%

Description

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.

Affected products

Vendor Trend Micro Product Trend Micro Smart Protection Server (Standalone) Default
n/a
- Version
  3.0, 3.1, 3.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Trend Micro

Trend Micro Smart Protection Server (Standalone)

n/a

Version	Status	Constraints
3.0, 3.1, 3.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-285

CWE-534

References (4)

http://www.securityfocus.com/bid/102275
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://success.trendmicro.com/solution/1118992
x_refsource_CONFIRMVendor Advisory
https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
x_refsource_MISCExploitThird Party Advisory
https://www.exploit-db.com/exploits/43388/
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Link	Providers	Tags
http://www.securityfocus.com/bid/102275		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://success.trendmicro.com/solution/1118992		x_refsource_CONFIRMVendor Advisory
https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities		x_refsource_MISCExploitThird Party Advisory
https://www.exploit-db.com/exploits/43388/		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner trendmicro

Published Jan 19, 2018

Updated Aug 5, 2024

Reserved Jul 17, 2017

Link CVE-2017-11398

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-11398

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-11398