CVE-2017-11391
HighSummary
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the 't' parameter within modTMCSS Proxy.
Risk Assessment
The risk to the organization is the potential for remote code execution, which could lead to system compromise and data leakage.
Recommendation
It is recommended to update to the latest version of Trend Micro InterScan Messaging Virtual Appliance to mitigate this vulnerability.
Other vulnerabilities in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1
Original NVD description (English source)
Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the "t" parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.