Reflected Cross-Site Scripting Vulnerability in Trend Micro Deep Discovery Inspector
CVE-2018-15365

5.4MEDIUM

Key Information:

Vendor
Trend Micro
Status
Trend Micro Deep Discovery Inspector
Vendor
CVE Published:
28 September 2018

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A reflected Cross-Site Scripting (XSS) vulnerability exists in Trend Micro Deep Discovery Inspector versions 3.85 and earlier. This flaw allows an attacker, who is already an authenticated user, to bypass the existing CSRF protections, enabling them to exploit vulnerable installations. By crafting a malicious link and convincing a user to click it, an attacker can execute arbitrary scripts within the user's browser context, potentially compromising sensitive information or user accounts.

Affected Version(s)

Trend Micro Deep Discovery Inspector 3.85

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-15365
Created by nixwizard

References

https://success.trendmicro.com/solution/1121079
x_refsource_CONFIRM
https://github.com/nixwizard/CVE-2018-15365/
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.