CVE-2017-14085

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Information disclosure vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access the OfficeScan server to query the network's NT domain or the PHP version and modules.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Trend Micro	Trend Micro OfficeScan	11.0, XG (12.0)

References

http://hyp3rlinx.altervista.org/advisories/CVE-2017-14085-TRENDMICRO-OFFICESCAN-XG-REMOTE-NT-DOMAIN-PHP-INFO-DISCLOSURE.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/144402/TrendMicro-OfficeScan-11.0-XG-12.0-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2017/Sep/85Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/541281/100/0/threaded
http://www.securityfocus.com/bid/101076Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039500Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/1118372Patch, Vendor Advisory
https://www.exploit-db.com/exploits/42893/Exploit, Third Party Advisory, VDB Entry
http://hyp3rlinx.altervista.org/advisories/CVE-2017-14085-TRENDMICRO-OFFICESCAN-XG-REMOTE-NT-DOMAIN-PHP-INFO-DISCLOSURE.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/144402/TrendMicro-OfficeScan-11.0-XG-12.0-Information-Disclosure.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2017/Sep/85Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/541281/100/0/threaded
http://www.securityfocus.com/bid/101076Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039500Third Party Advisory, VDB Entry
https://success.trendmicro.com/solution/1118372Patch, Vendor Advisory
https://www.exploit-db.com/exploits/42893/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Oct 6, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-140867.5Pre-authorization Start Remote Process vulnerabilities in Trend Micro OfficeScan 11.0 and XG may allow unauthenticated users who can access CVE-2017-140877.5A Host Header Injection vulnerability in Trend Micro OfficeScan XG (12.0) may allow an attacker to spoof a particular Host header, allowing CVE-2017-140887.0Memory Corruption Privilege Escalation vulnerabilities in Trend Micro OfficeScan 11.0 and XG allows local attackers to execute arbitrary cod CVE-2017-140899.8An Unauthorized Memory Corruption vulnerability in Trend Micro OfficeScan 11.0 and XG may allow remote unauthenticated users who can access CVE-2017-14095.3IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The informatio CVE-2017-140909.1A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted.CVE-2017-140917.5A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which certain specific installations that utilize a uncommon feature - O CVE-2017-140928.8The absence of Anti-CSRF tokens in Trend Micro ScanMail for Exchange 12.0 web interface forms could allow an attacker to submit authenticate CVE-2017-140936.1The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting (XSS) attacks.CVE-2017-140949.8A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command CVE-2017-140958.1A vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to perform remote command CVE-2017-140966.1A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an