VULNERABILITY INTELLIGENCE
CVE-2017-11398
CVSS score8.8 HIGH
EPSS probability8.20%
CISA KEVNot currently listed
Published2018-01-19
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Description
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.
Weakness classification
- CWE-285: Improper Authorization
- CWE-534: DEPRECATED: Information Exposure Through Debug Log Files
Primary references
- security@trendmicro.com — Third Party Advisory, VDB Entry
- security@trendmicro.com — Vendor Advisory
- security@trendmicro.com — Exploit, Third Party Advisory
- security@trendmicro.com — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry