CVE-2017-9037

Description

Multiple cross-site scripting (XSS) vulnerabilities in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allow remote attackers to inject arbitrary web script or HTML via the (1) S44, (2) S5, (3) S_action_fail, (4) S_ptn_update, (5) T113, (6) T114, (7) T115, (8) T117117, (9) T118, (10) T_action_fail, (11) T_ptn_update, (12) textarea, (13) textfield5, or (14) tmLastConfigFileModifiedDate parameter to notification.cgi.

References

https://www.coresecurity.com/advisories/trend-micro-serverprotect-multiple-vulnerabilities

https://success.trendmicro.com/solution/1117411

http://www.securitytracker.com/id/1038548

http://seclists.org/fulldisclosure/2017/May/91

http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3