CVE-2016-8587
dlp_policy_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via an archive file containing a symlink to /eng_ptn_stores/prod/sensorSDK/data/ or /eng_ptn_stores/prod/sensorSDK/backup_pol/.
- Affected products
- Trend Micro Threat Discovery Appliance
- Trendmicro Threat Discovery Appliance
- ≤ 2.6.1062
- Fix
- Available
- CVSS 3.0
- 7.3 HIGH
- EPSS
- 2.5% (83th percentile)
- Weakness
- CWE-284
- NVD status
- Modified
- Published
- 2017-04-28
CVE-2016-8587 at NVD
4 known exploits for CVE-2016-8587
Proof-of-concept code and exploit modules indexed by Sploitus
Trend Micro Threat Discovery Appliance <= 2.6.1062r1 dlp_policy_upload.cgi Remote Code Execution Vulnerability (CVE-2016-8587)
Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Remote Code Execution Exploi
Trend Micro Threat Discovery Appliance 2.6.1062r1 dlp_policy_upload.cgi Remote Code Execution
Trend Micro Threat Discovery Appliance - Session Generation Authentication Bypass (CVE-2016-8584)