CVE-2018-15365

Description

A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability.

Weakness classification

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

• security@trendmicro.com — Exploit, Mitigation, Third Party Advisory
• security@trendmicro.com — Mitigation, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mitigation, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Vendor Advisory