The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks. NOTE: this can be leveraged for code execution through an unspecified "manipulation of the configuration."
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 00:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://secunia.com/advisories/31373 - Broken Link, Patch, Vendor Advisory | |
| References | () http://secunia.com/secunia_research/2008-31/advisory/ - Broken Link, Vendor Advisory | |
| References | () http://securityreason.com/securityalert/4191 - Broken Link | |
| References | () http://www.securityfocus.com/archive/1/495670/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry | |
| References | () http://www.securityfocus.com/bid/30792 - Broken Link, Third Party Advisory, VDB Entry | |
| References | () http://www.securitytracker.com/id?1020732 - Broken Link, Third Party Advisory, VDB Entry | |
| References | () http://www.trendmicro.com/ftp/documentation/readme/OSCE_8.0_SP1_Win_EN_CriticalPatch_B2402_readme.txt - Vendor Advisory | |
| References | () http://www.trendmicro.com/ftp/documentation/readme/Readme_WFBS5%200_EN_CriticalPatch1404.txt - Vendor Advisory | |
| References | () http://www.vupen.com/english/advisories/2008/2421 - Broken Link | |
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/44597 - Third Party Advisory, VDB Entry |
14 Feb 2024, 16:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) http://www.trendmicro.com/ftp/documentation/readme/OSCE_8.0_SP1_Win_EN_CriticalPatch_B2402_readme.txt - Vendor Advisory | |
| References | (SECTRACK) http://www.securitytracker.com/id?1020732 - Broken Link, Third Party Advisory, VDB Entry | |
| References | (BUGTRAQ) http://www.securityfocus.com/archive/1/495670/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry | |
| References | (CONFIRM) http://www.trendmicro.com/ftp/documentation/readme/Readme_WFBS5%200_EN_CriticalPatch1404.txt - Vendor Advisory | |
| References | (VUPEN) http://www.vupen.com/english/advisories/2008/2421 - Broken Link | |
| References | (SREASON) http://securityreason.com/securityalert/4191 - Broken Link | |
| References | (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/44597 - Third Party Advisory, VDB Entry | |
| References | (MISC) http://secunia.com/secunia_research/2008-31/advisory/ - Broken Link, Vendor Advisory | |
| References | (BID) http://www.securityfocus.com/bid/30792 - Broken Link, Third Party Advisory, VDB Entry | |
| References | (SECUNIA) http://secunia.com/advisories/31373 - Broken Link, Patch, Vendor Advisory | |
| CWE | CWE-330 | |
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
| CPE | cpe:2.3:a:trend_micro:client_server_messaging_suite:3.5:*:*:*:*:*:*:* cpe:2.3:a:trend_micro:officescan:7.3:*:*:*:*:*:*:* cpe:2.3:a:trend_micro:officescan:7.0:*:*:*:*:*:*:* cpe:2.3:a:trend_micro:worry_free_business_security:5.0:*:*:*:*:*:*:* cpe:2.3:a:trend_micro:client_server_messaging_suite:3.6:*:*:*:*:*:*:* |
cpe:2.3:a:trendmicro:officescan:*:*:*:*:*:*:*:* cpe:2.3:a:trendmicro:worry-free_business_security:5.0:*:*:*:*:*:*:* cpe:2.3:a:trendmicro:client_server_messaging_suite:3.5:*:*:*:*:*:*:* cpe:2.3:a:trendmicro:client_server_messaging_suite:3.6:*:*:*:*:*:*:* |
| First Time |
Trendmicro officescan
Trendmicro client Server Messaging Suite Trendmicro worry-free Business Security Trendmicro |
Information
Published : 2008-08-27 20:41
Updated : 2024-11-21 00:46
NVD link : CVE-2008-2433
Mitre link : CVE-2008-2433
CVE.ORG link : CVE-2008-2433
JSON object : View
Products Affected
trendmicro
- worry-free_business_security
- client_server_messaging_suite
- officescan
CWE
CWE-330
Use of Insufficiently Random Values