CVE-2008-2433: Trend Micro Client Server Messaging Suite

Critical severity, CVSS 9.8. EPSS: 10.9% chance of exploitation in the next 30 days.

The web management console in Trend Micro OfficeScan 7.0 through 8.0, Worry-Free Business Security 5.0, and Client/Server/Messaging Suite 3.5 and 3.6 creates a random session token based only on the login time, which makes it easier for remote attackers to hijack sessions via brute-force attacks. NOTE: this can be leveraged for code execution through an unspecified "manipulation of the configuration."

Affected products

• Trend Micro Client Server Messaging Suite: version 3.5 only; version 3.6 only
• Trend Micro OfficeScan: from 7.0, up to and including 8.0
• Trend Micro Worry-Free Business Security: version 5.0 only

Published 2008-08-27. Last modified 2026-06-16.