Vulnerability Details : CVE-2017-14087
Potential exploit
A Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) may allow an attacker to spoof a particular Host header, allowing the attacker to render arbitrary links that point to a malicious website with poisoned Host header webpages.
Vulnerability category: Input validation
Products affected by CVE-2017-14087
- cpe:2.3:a:trendmicro:officescan:12.0:*:*:*:*:*:*:*
- cpe:2.3:a:trendmicro:officescan:11.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-14087
22.46%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-14087
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2017-14087
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-14087
-
http://www.securityfocus.com/bid/101074
Trend Micro OfficeScan CVE-2017-14087 Host Header Injection VulnerabilityThird Party Advisory;VDB Entry
-
https://success.trendmicro.com/solution/1118372
Critical patches to fix multiple vulnerabilities - OfficeScanMitigation;Vendor Advisory
-
http://packetstormsecurity.com/files/144404/TrendMicro-OfficeScan-11.0-XG-12.0-Host-Header-Injection.html
TrendMicro OfficeScan 11.0 / XG (12.0) Host Header Injection ≈ Packet StormExploit;Third Party Advisory;VDB Entry
-
https://www.exploit-db.com/exploits/42895/
Trend Micro OfficeScan 11.0/XG (12.0) - 'Host' Header InjectionExploit;Third Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1039500
Trend Micro OfficeScan Multiple Flaws Let Remote Users Execute Arbitrary Code on the Target System - SecurityTrackerThird Party Advisory;VDB Entry
-
http://hyp3rlinx.altervista.org/advisories/CVE-2017-14087-TRENDMICRO-OFFICESCAN-XG-HOST-HEADER-INJECTION.txt
Exploit;Third Party Advisory
-
http://seclists.org/fulldisclosure/2017/Sep/86
Full Disclosure: Trend Micro OfficeScan v11.0 and XG (12.0)* Host Header Injection CVE-2017-14087Exploit;Mailing List;Third Party Advisory
-
http://www.securityfocus.com/archive/1/541267/100/0/threaded
SecurityFocus
Jump to