CVE-2017-6340 : What You Need to Know

Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5 before CP 1746 is affected by a security vulnerability that allows for the injection of malicious JavaScript code by authenticated users with low privileges. This flaw can be exploited to execute the injected code when accessing specific pages.

Understanding CVE-2017-6340

This CVE entry describes a vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) version 6.5 before CP 1746 that enables authenticated users to inject malicious JavaScript code.

What is CVE-2017-6340?

The vulnerability in Trend Micro IWSVA allows users with limited privileges to insert harmful JavaScript code, which can later be executed when other users access certain pages within the application.

The Impact of CVE-2017-6340

The security flaw in IWSVA version 6.5 poses a risk of executing unauthorized JavaScript code within the application, potentially leading to various security breaches and attacks.

Technical Details of CVE-2017-6340

Trend Micro IWSVA version 6.5 before CP 1746 is susceptible to a security vulnerability that allows for the injection of malicious JavaScript code by authenticated users with low privileges.

Vulnerability Description

The flaw arises from the improper sanitization of the 'Reports Only' user's input, enabling the injection of malicious JavaScript code. Additionally, incorrect access control implementation permits even low-privileged users to create or modify reports, exploiting the XSS vulnerability.

Affected Systems and Versions

Product: Trend Micro InterScan Web Security Virtual Appliance (IWSVA)
Version: 6.5 before CP 1746

Exploitation Mechanism

The vulnerability can be exploited by authenticated users, including those with low privileges like 'Auditor,' who can inject malicious JavaScript code into specific fields. The injected code is executed when other users access reports or auditlog pages.

Mitigation and Prevention

To address CVE-2017-6340, users and administrators should take immediate steps and adopt long-term security practices to mitigate the risks associated with this vulnerability.

Immediate Steps to Take

Apply the necessary security patches provided by Trend Micro for IWSVA version 6.5.
Monitor and restrict user privileges to prevent unauthorized access and code injection.

Long-Term Security Practices

Regularly update and patch the IWSVA software to address security vulnerabilities.
Conduct security training for users to raise awareness about safe practices and potential risks.

Patching and Updates

Ensure that the IWSVA software is regularly updated with the latest patches and security fixes to prevent exploitation of known vulnerabilities.