A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system.
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
This entry has been deprecated because its abstraction was too low-level. See CWE-532.
| Link | Tags |
|---|---|
| https://www.exploit-db.com/exploits/43388/ | third party advisory vdb entry exploit |
| http://www.securityfocus.com/bid/102275 | third party advisory vdb entry |
| https://success.trendmicro.com/solution/1118992 | vendor advisory |
| https://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities | third party advisory exploit |