CVE-2017-6398

An issue was discovered in Trend Micro InterScan Messaging Security (Virtual Appliance) 9.1-1600. An authenticated user can execute a terminal command in the context of the web server user (which is root). Besides, the default installation of IMSVA comes with default administrator credentials. The saveCert.imss endpoint takes several user inputs and performs blacklisting. After that, it uses them as arguments to a predefined operating-system command without proper sanitization. However, because of an improper blacklisting rule, it's possible to inject arbitrary commands into it.

• CWE-78

• http://www.securityfocus.com/bid/96859
• https://www.rapid7.com/db/modules/exploit/linux/http/trend_micro_imsva_execThird Party Advisory
• http://www.securityfocus.com/bid/96859
• https://www.rapid7.com/db/modules/exploit/linux/http/trend_micro_imsva_execThird Party Advisory

Published

Mar 14, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-6392An issue was discovered in Kaltura server Lynx-12.11.0. The …
• CVE-2017-6393An issue was discovered in NagVis 1.9b12. The vulnerability …
• CVE-2017-6394Multiple Cross-Site Scripting (XSS) issues were discovered i…6.1
• CVE-2017-6395An issue was discovered in HashOver 2.0. The vulnerability e…
• CVE-2017-6396An issue was discovered in WPO-Foundation WebPageTest 3.0. T…
• CVE-2017-6397An issue was discovered in FlightAirMap v1.0-beta.10. The vu…6.1
• CVE-2017-6399An issue was discovered in Veritas NetBackup Before 7.7.2 an…
• CVE-2017-6400An issue was discovered in Veritas NetBackup Before 7.7.2 an…
• CVE-2017-6401An issue was discovered in Veritas NetBackup before 8.0 and …
• CVE-2017-6402An issue was discovered in Veritas NetBackup 8.0 and earlier…
• CVE-2017-6403An issue was discovered in Veritas NetBackup Before 8.0 and …
• CVE-2017-6404An issue was discovered in Veritas NetBackup Before 7.7 and …