CVE-2017-14085 Information disclosure in Trend Micro OfficeScan
Unauthenticated attackers can query the network's NT domain and PHP version details from the Trend Micro OfficeScan server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-14085?
CVE-2017-14085 is a medium-severity vulnerability in Trendmicro Officescan, published on 5 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to query the network's NT domain or the PHP version and modules.
Weakness: CWE-200
Which versions are affected by CVE-2017-14085?
It affects 1 product.
Products include Trendmicro Officescan.
How do I fix CVE-2017-14085?
No fix has been published for CVE-2017-14085 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-14085 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-14085 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Trendmicro Officescan
Sources
Also known as GHSA-69cp-8qx2-fq5h.