CVE-2012-2998
Summary
| CVE | CVE-2012-2998 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2012-09-28 10:40:00 UTC |
| Updated | 2013-02-14 04:53:00 UTC |
| Description | SQL injection vulnerability in the ad hoc query module in Trend Micro Control Manager (TMCM) before 5.5.0.1823 and 6.0 before 6.0.0.1449 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
Risk And Classification
Problem Types: CWE-89
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Trend Micro | Control Manager | 2.0 | All | All | All |
| Application | Trend Micro | Control Manager | 2.1 | All | All | All |
| Application | Trend Micro | Control Manager | 2.5 | All | All | All |
| Application | Trend Micro | Control Manager | 3.0 | All | ent_ed | All |
| Application | Trend Micro | Control Manager | 3.0 | All | std_ed | All |
| Application | Trend Micro | Control Manager | 3.5 | All | ent_ed | All |
| Application | Trend Micro | Control Manager | 3.5 | All | std_ed | All |
| Application | Trend Micro | Control Manager | 5.0 | All | adv_ed | All |
| Application | Trend Micro | Control Manager | 5.0 | All | std_ed | All |
| Application | Trend Micro | Control Manager | 5.5 | All | adv_ed | All |
| Application | Trend Micro | Control Manager | 6.0 | All | All | All |
| Application | Trend Micro | Control Manager | 2.0 | All | All | All |
| Application | Trend Micro | Control Manager | 2.1 | All | All | All |
| Application | Trend Micro | Control Manager | 2.5 | All | All | All |
| Application | Trend Micro | Control Manager | 3.0 | All | ent_ed | All |
| Application | Trend Micro | Control Manager | 3.0 | All | std_ed | All |
| Application | Trend Micro | Control Manager | 3.5 | All | ent_ed | All |
| Application | Trend Micro | Control Manager | 3.5 | All | std_ed | All |
| Application | Trend Micro | Control Manager | 5.0 | All | adv_ed | All |
| Application | Trend Micro | Control Manager | 5.0 | All | std_ed | All |
| Application | Trend Micro | Control Manager | 5.5 | All | adv_ed | All |
| Application | Trend Micro | Control Manager | 6.0 | All | All | All |
| Application | Trend Micro | Control Manager | All | All | std_ed | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| US-CERT Vulnerability Note VU#950795 - Trend Micro Control Manager adhoc query vulnerability | CERT-VN | www.kb.cert.org | US Government Resource |
| www.trendmicro.com/ftp/documentation/readme/readme_critical_patch_TMCM55_1823.txt | CONFIRM | www.trendmicro.com | Patch |
| Trend Micro Control Manager SQL Injection Vulnerability | Spentera | MISC | www.spentera.com | Patch |
| JVN#42014489: Trend Micro Control Manager vulnerable to SQL injection | JVN | jvn.jp | Patch |
| www.trendmicro.com/ftp/documentation/readme/readme_critical_patch_tmcm60_patch1_... | CONFIRM | www.trendmicro.com | Patch |
| SQL injection vulnerability - Control Manager | CONFIRM | esupport.trendmicro.com | Vendor Advisory |
| JVNDB-2012-000090 | JVNDB | jvndb.jvn.jp | Patch |
| Trend Micro Control Manager Input Validation Flaw in Ad Hoc Query Module Lets Remote Users Inject SQL Commands - SecurityTracker | SECTRACK | www.securitytracker.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.