CVE-2017-14095 : A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to pe

A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command execution via a local file inclusion on a vulnerable system.

Published 2018-01-19 19:29:01

Updated 2019-10-09 23:23:48

Source Trend Micro, Inc.

View at NVD, CVE.org

Vulnerability category: File inclusion

Exploit prediction scoring system (EPSS) score for CVE-2017-14095

EPSS FAQ

0.62%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 76 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-14095

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
8.1	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	2.2	5.9	NIST
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-14095

CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

Assigned by: security@trendmicro.com (Secondary)

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2017-14095

https://success.trendmicro.com/solution/1118992

Multiple vulnerabilities in Smart Protection Server
Vendor Advisory

CVEs referencing this url
https://www.exploit-db.com/exploits/43388/

Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Con
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/bid/102275

Trend Micro Smart Protection Server Multiple Security Vulnerabilities
Third Party Advisory;VDB Entry

CVEs referencing this url
https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities

Trend Micro Smart Protection Server Multiple Vulnerabilities | Core Security
Exploit;Third Party Advisory

CVEs referencing this url

Products affected by CVE-2017-14095

Trendmicro » Smart Protection Server
Versions up to, including, (<=) 3.2
cpe:2.3:a:trendmicro:smart_protection_server:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2017-14095

Exploit prediction scoring system (EPSS) score for CVE-2017-14095

CVSS scores for CVE-2017-14095

CWE ids for CVE-2017-14095

References for CVE-2017-14095

Products affected by CVE-2017-14095