CVEvulnerability
CVE-2017-11394
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-08-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-20
Description
Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544.
Affected configurations
• trendmicro officescan 11.0
• trendmicro officescan 12.0
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://www.securityfocus.com/bid/100130 Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-17-521 Third Party Advisory, VDB Entry
- https://success.trendmicro.com/solution/1117769 Mitigation, Patch, Vendor Advisory
- https://www.exploit-db.com/exploits/42971/ www.exploit-db.com
- http://www.securityfocus.com/bid/100130 Third Party Advisory, VDB Entry
- http://www.zerodayinitiative.com/advisories/ZDI-17-521 Third Party Advisory, VDB Entry
- https://success.trendmicro.com/solution/1117769 Mitigation, Patch, Vendor Advisory
- https://www.exploit-db.com/exploits/42971/ www.exploit-db.com