{"api_version":"1","generated_at":"2026-07-23T06:34:11+00:00","cve":"CVE-2017-9033","urls":{"html":"https://cve.report/CVE-2017-9033","api":"https://cve.report/api/cve/CVE-2017-9033.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-9033","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-9033"},"summary":{"title":"CVE-2017-9033","description":"Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoption_set.cgi, related to the lack of anti-CSRF tokens.","state":"PUBLISHED","assigner":"mitre","published_at":"2017-05-26 01:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"8.8","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://seclists.org/fulldisclosure/2017/May/91","name":"http://seclists.org/fulldisclosure/2017/May/91","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Mailing List","Third Party Advisory"],"title":"Full Disclosure: [CORE-2017-0002] - Trend Micro ServerProtect Multiple\tVulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://success.trendmicro.com/solution/1117411","name":"https://success.trendmicro.com/solution/1117411","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Multiple Vulnerabilities - ServerProtect for Linux 3.0","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html","name":"http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory","VDB Entry"],"title":"Trend Micro ServerProtect Disclosure / CSRF / XSS ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.coresecurity.com/advisories/trend-micro-serverprotect-multiple-vulnerabilities","name":"https://www.coresecurity.com/advisories/trend-micro-serverprotect-multiple-vulnerabilities","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Technical Description","Third Party Advisory"],"title":"Trend Micro ServerProtect Multiple Vulnerabilities | Core Security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1038548","name":"http://www.securitytracker.com/id/1038548","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Trend Micro ServerProtect for Linux Multiple Bugs Let Remote Users Execute Arbitrary Code and Conduct Cross-Site Scripting and Cross-Site Request Forgery Attacks and Let Local Users Gain Elevated Privileges - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-9033","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-9033","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"9033","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"trendmicro","cpe5":"serverprotect","cpe6":"3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"linux","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T16:55:21.874Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1038548","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1038548"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://success.trendmicro.com/solution/1117411"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.coresecurity.com/advisories/trend-micro-serverprotect-multiple-vulnerabilities"},{"name":"20170523 [CORE-2017-0002] - Trend Micro ServerProtect Multiple Vulnerabilities","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2017/May/91"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2017-05-23T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoption_set.cgi, related to the lack of anti-CSRF tokens."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-05-25T18:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1038548","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1038548"},{"tags":["x_refsource_CONFIRM"],"url":"https://success.trendmicro.com/solution/1117411"},{"tags":["x_refsource_MISC"],"url":"https://www.coresecurity.com/advisories/trend-micro-serverprotect-multiple-vulnerabilities"},{"name":"20170523 [CORE-2017-0002] - Trend Micro ServerProtect Multiple Vulnerabilities","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2017/May/91"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2017-9033","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoption_set.cgi, related to the lack of anti-CSRF tokens."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1038548","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1038548"},{"name":"https://success.trendmicro.com/solution/1117411","refsource":"CONFIRM","url":"https://success.trendmicro.com/solution/1117411"},{"name":"https://www.coresecurity.com/advisories/trend-micro-serverprotect-multiple-vulnerabilities","refsource":"MISC","url":"https://www.coresecurity.com/advisories/trend-micro-serverprotect-multiple-vulnerabilities"},{"name":"20170523 [CORE-2017-0002] - Trend Micro ServerProtect Multiple Vulnerabilities","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2017/May/91"},{"name":"http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/142645/Trend-Micro-ServerProtect-Disclosure-CSRF-XSS.html"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2017-9033","datePublished":"2017-05-25T19:00:00.000Z","dateReserved":"2017-05-17T00:00:00.000Z","dateUpdated":"2024-08-05T16:55:21.874Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-05-26 01:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:trendmicro:serverprotect:3.0:*:*:*:*:linux:*:*","matchCriteriaId":"D0E9F49F-7151-4150-A31D-CA68D0D4C268"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"9033","Ordinal":"1","Title":"CVE-2017-9033","CVE":"CVE-2017-9033","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"9033","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows remote attackers to hijack the authentication of users for requests to start an update from an arbitrary source via a crafted request to SProtectLinux/scanoption_set.cgi, related to the lack of anti-CSRF tokens.","Type":"Description","Title":"CVE-2017-9033"},{"CveYear":"2017","CveId":"9033","Ordinal":"2","NoteData":"2017-05-25","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"9033","Ordinal":"3","NoteData":"2017-05-25","Type":"Other","Title":"Modified"}]}}}