CVE-2017-11398

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.

• CWE-285
• CWE-534

• http://www.securityfocus.com/bid/102275Third Party Advisory, VDB Entry
• https://success.trendmicro.com/solution/1118992Vendor Advisory
• https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilitiesExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/43388/Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/102275Third Party Advisory, VDB Entry
• https://success.trendmicro.com/solution/1118992Vendor Advisory
• https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilitiesExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/43388/Third Party Advisory, VDB Entry

Published

Jan 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11392Proxy command injection vulnerability in Trend Micro InterSc…
• CVE-2017-11393Proxy command injection vulnerability in Trend Micro OfficeS…
• CVE-2017-11394Proxy command injection vulnerability in Trend Micro OfficeS…
• CVE-2017-11395Command injection vulnerability in Trend Micro Smart Protect…
• CVE-2017-11396Vulnerability issues with the web service inspection of inpu…7.2
• CVE-2017-11397A service DLL preloading vulnerability in Trend Micro Encryp…
• CVE-2017-11399Integer overflow in the ape_decode_frame function in libavco…
• CVE-2017-1140IBM Business Process Manager 8.0 and 8.5 are vulnerable to c…
• CVE-2017-11400An issue has been discovered on the Belden Hirschmann Tofino…
• CVE-2017-11401An issue has been discovered on the Belden Hirschmann Tofino…
• CVE-2017-11402An issue has been discovered on the Belden Hirschmann Tofino…
• CVE-2017-11403The ReadMNGImage function in coders/png.c in GraphicsMagick …