Trend Micro Deep Discovery Inspector SQL Injection Vulnerabilities (CVE-2024-46902/46903)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Product and Version: - Affected products include: Deep Discovery Inspector 5.8, Deep Discovery Inspector 6.0, Deep Discovery Inspector 5.8 Service Pack 1, Deep Discovery Inspector 6.6, Deep Discovery Inspector 6.5, Deep Discovery Inspector 6.2, Deep Discovery Inspector 5.8 Service Pack 2, Deep Discovery Inspector 6.7. 2. Vulnerability Details: - CVE-2024-46902: SQL Injection Information Disclosure Vulnerability - CVE-2024-46903: SQL Injection Information Disclosure Vulnerability - CVSSv3 Score: 4.9 - 6.5 - Severity Rating: Medium 3. Affected Versions: - Deep Discovery Inspector 5.8 and later versions - Deep Discovery Inspector 6.6 prior to 1097 - Deep Discovery Inspector 6.7 prior to 1107 4. Solution: - Updated versions of Deep Discovery Inspector are provided, including 6.6 CP 1097 and 6.7 CP 1107. - Users are strongly advised to obtain the latest version of the product if updates are available. 5. Vulnerability Details: - The vulnerability allows attackers to disclose sensitive information after gaining high-privilege code (administrator privileges). - The vulnerability also allows attackers to disclose sensitive information after gaining low-privilege code. 6. Mitigation Factors: - Attackers require physical or remote access to the target system. - It is recommended to promptly apply patches and update solutions, while reviewing remote access and perimeter security policies. 7. Acknowledgments: - Thanks to Kentaro Kawane, working with GMO Cybersecurity by Ierae, for collaborating with Trend Micro’s Zero Day Initiative to disclose these issues. This information provides a detailed description of the vulnerability, including affected products, versions, vulnerability details, solutions, and mitigation factors.

Goal Reached Thanks to every supporter — we hit 100%!

Trend Micro Deep Discovery Inspector SQL Injection Vulnerabilities (CVE-2024-46902/46903)