« Volver al listado

CVE-2018-6237

Estado: ModificadaAlta (7.5)—

A vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow an unauthenticated remote attacker to manipulate the product to send a large number of specially crafted HTTP requests to potentially cause the file system to fill up, eventually causing a denial of service (DoS) situation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Trendmicro — Smart Protection Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-6237",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@trendmicro.com",
      "affectedData": [
        {
          "vendor": "Trend Micro",
          "product": "Trend Micro Smart Protection Server (Standalone)",
          "versions": [
            {
              "status": "affected",
              "version": "3.0, 3.1, 3.2, 3.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-05-25T15:29:00.587",
  "references": [
    {
      "url": "https://success.trendmicro.com/solution/1119715",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@trendmicro.com"
    },
    {
      "url": "https://www.tenable.com/security/research/tra-2018-10",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security@trendmicro.com"
    },
    {
      "url": "https://success.trendmicro.com/solution/1119715",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.tenable.com/security/research/tra-2018-10",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in Trend Micro Smart Protection Server (Standalone) 3.x could allow an unauthenticated remote attacker to manipulate the product to send a large number of specially crafted HTTP requests to potentially cause the file system to fill up, eventually causing a denial of service (DoS) situation."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en Trend Micro Smart Protection Server (Standalone) 3.x podría permitir que un atacante remoto no autenticado manipule el producto para enviar un gran número de peticiones HTTP especialmente manipuladas para provocar que el sistema de archivos se llene, provocando finalmente una denegación de servicio (DoS)."
    }
  ],
  "lastModified": "2026-06-17T02:01:33.630",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:trendmicro:smart_protection_server:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E74019C0-01AD-4C0F-9ADE-099D6D7C8013"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:smart_protection_server:3.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CB62FC55-4EA1-485E-9381-C14BA2F1E074"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:smart_protection_server:3.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4157366A-854E-4993-B08B-FAF7EA4D9ED2"
            },
            {
              "criteria": "cpe:2.3:a:trendmicro:smart_protection_server:3.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD4082E4-88CC-4B48-AA49-B5EC28950D36"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@trendmicro.com"
}