Trend Micro Deep Discovery Inspector SQL Injection Information Disclosure (CVE-2024-46903)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Name: Trend Micro Deep Discovery Inspector SQL Injection Information Disclosure Vulnerability 2. Vulnerability ID: ZDI-24-1228, ZDI-CAN-24585 3. CVE ID: CVE-2024-46903 4. CVSS Score: 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 5. Affected Vendor: Trend Micro 6. Affected Product: Deep Discovery Inspector 7. Vulnerability Details: - Remote attackers can exploit this vulnerability to disclose sensitive information on affected Trend Micro Deep Discovery Inspector installations. - The specific flaw exists in a web service listening on TCP port 443. The issue arises from insufficient validation of user-supplied strings before being used to construct SQL queries. - Attackers can leverage this vulnerability to disclose information within the context of the service account. 8. Additional Details: - Trend Micro has released updates to fix this vulnerability. - More details are available at: https://success.trendmicro.com/en-US/solution/KA-0017793 9. Disclosure Timeline: - 2024-08-16 - Vulnerability reported to vendor - 2024-09-17 - Coordinated public disclosure of vulnerability advisory - 2024-09-17 - Vulnerability advisory updated 10. Credit: - Kentaro Kawane, GMO Cybersecurity by Ierae This information provides a detailed description of the vulnerability, including its severity, affected systems and vendors, exploitation methods, and remediation details.

Goal Reached Thanks to every supporter — we hit 100%!

Trend Micro Deep Discovery Inspector SQL Injection Information Disclosure (CVE-2024-46903)