6.5med
CVE-2017-63381 exploit
Multiple Access Control issues in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 allow an authenticated, r…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.9%
percentile 90%
Public exploits
1
Exploit-DB
Summary
Multiple Access Control issues in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 allow an authenticated, remote user with low privileges like 'Reports Only' or 'Auditor' to change FTP Access Control Settings, create or modify reports, or upload an HTTPS Decryption Certificate and Private Key.
Exploit prediction (EPSS)
3.92% probability of exploitation in the next 30 days, higher than 90% of all scored CVEs.
Exploits and detections
- EDB-42013 Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities · webapps · 2017-01-12
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Classification
- Weakness
- CWE-732 Incorrect Permission Assignment for Critical Resource
References
- success.trendmicro.com /solution/1116960 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/97482 · vdb-entry, x_refsource_BID, x_transferred
- qualys.com /2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdf · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-6338
- NVD: CVE-2017-6338
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.