Trend Micro Email Encryption Gateway CVE-2018-6227 HTML Injection Vulnerability
BID:103443
Info
Trend Micro Email Encryption Gateway CVE-2018-6227 HTML Injection Vulnerability
| Bugtraq ID: | 103443 |
| Class: | Input Validation Error |
| CVE: |
CVE-2018-6227 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 21 2018 12:00AM |
| Updated: | Feb 21 2018 12:00AM |
| Credit: | Leandro Barragan and Maximilian Vidal for Core Security Consulting and Vahagn Vardanyan. |
| Vulnerable: |
Trend Micro Email Encryption Gateway 5.5 build 1111 Trend Micro Email Encryption Gateway 5.5 build 1107 Trend Micro Email Encryption Gateway 5.5 build 1073 |
| Not Vulnerable: |
Trend Micro Email Encryption Gateway 5.5 build 1129 |
Discussion
Trend Micro Email Encryption Gateway CVE-2018-6227 HTML Injection Vulnerability
Trend Micro Email Encryption Gateway is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Trend Micro Email Encryption Gateway 5.5 Build 1111 and prior versions are vulnerable.
Trend Micro Email Encryption Gateway is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Trend Micro Email Encryption Gateway 5.5 Build 1111 and prior versions are vulnerable.