CVE-2018-15365

5.4MEDIUM

Key Information:

Vendor
Trend Micro
Status
Trend Micro Deep Discovery Inspector
Vendor
CVE Published:
28 September 2018

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypass CSRF protection and conduct an attack on vulnerable installations. An attacker must be an authenticated user in order to exploit the vulnerability.

Affected Version(s)

Trend Micro Deep Discovery Inspector 3.85

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-15365
Created by nixwizard

References

https://success.trendmicro.com/solution/1121079
x_refsource_CONFIRM
https://github.com/nixwizard/CVE-2018-15365/
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.