CVE-2016-6269

CRITICAL

Trend Micro Smart Protection Server <3.0.1330 - Path Traversal

Title source: llm

Description

Multiple directory traversal vulnerabilities in Trend Micro Smart Protection Server 2.5 before build 2200, 2.6 before build 2106, and 3.0 before build 1330 allow remote attackers to read and delete arbitrary files via the tmpfname parameter to (1) log_mgt_adhocquery_ajaxhandler.php, (2) log_mgt_ajaxhandler.php, (3) log_mgt_ajaxhandler.php or (4) tf parameter to wcs_bwlists_handler.php.

References (2)

Core 2

Core References

Exploit, Technical Description, Third Party Advisory x_refsource_misc

https://qkaiser.github.io/pentesting/trendmicro/2016/08/08/trendmicro-sps/

Mitigation, Patch, Vendor Advisory x_refsource_confirm

https://success.trendmicro.com/solution/1114913

Scores

CVSS v3 9.1

EPSS 0.0185

EPSS Percentile 83.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE

CWE-22

Status published

Products (3)

trendmicro/smart_protection_server 2.5

trendmicro/smart_protection_server 2.6

trendmicro/smart_protection_server 3.0

Published Jan 30, 2017

Tracked Since Feb 18, 2026