7.8high
CVE-2016-6268
Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to e…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 62%
Public exploits
0
none known
Summary
Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allows local webserv users to execute arbitrary code with root privileges via a Trojan horse .war file in the Solr webapps directory.
Exploit prediction (EPSS)
0.98% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
References
- qkaiser.github.io /pentesting/trendmicro/2016/08/08/trendmicro-sps/ · x_refsource_MISC, x_transferred
- success.trendmicro.com /solution/1114913 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2016-6268
- NVD: CVE-2016-6268
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.