Lucene search

TrendmicroCVE-2020-24556

HistorySep 01, 2020 - 7:15 p.m.

CVE-2020-24556

2020-09-0119:15:11

CWE-59

trendmicro

web.nvd.nist.gov

cve-2020-24556

trend micro

apex one

officescan xg sp1

worry-free business security

vulnerability

microsoft windows

privilege escalation

code execution

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

33.9%

JSON

A vulnerability in Trend Micro Apex One, OfficeScan XG SP1, Worry-Free Business Security 10 SP1 and Worry-Free Business Security Services on Microsoft Windows may allow an attacker to create a hard link to any file on the system, which then could be manipulated to gain a privilege escalation and code execution. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.

Affected configurations

Nvd

Node

microsoftwindowsMatch-

AND

trendmicroapex_oneMatch2019

trendmicroapex_oneMatchsaas

Node

applemacosMatch-

microsoftwindowsMatch-

AND

trendmicroworry-free_business_securityMatch10.0sp1

trendmicroworry-free_business_security_servicesMatch-

VendorProductVersionCPE
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
trendmicroapex_one2019cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*
trendmicroapex_onesaascpe:2.3:a:trendmicro:apex_one:saas:*:*:*:*:*:*:*
applemacos-cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
trendmicroworry-free_business_security10.0cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:*
trendmicroworry-free_business_security_services-cpe:2.3:a:trendmicro:worry-free_business_security_services:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
trendmicro	apex_one	2019	cpe:2.3:a:trendmicro:apex_one:2019:::::::*
trendmicro	apex_one	saas	cpe:2.3:a:trendmicro:apex_one:saas:::::::*
apple	macos	-	cpe:2.3:o:apple:macos:-:::::::*
trendmicro	worry-free_business_security	10.0	cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1::::::
trendmicro	worry-free_business_security_services	-	cpe:2.3:a:trendmicro:worry-free_business_security_services:-:::::::*

CNA Affected

[
  {
    "product": "Trend Micro Apex One",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "2009 (on premise), SaaS"
      }
    ]
  },
  {
    "product": "Trend Micro OfficeScan",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "XG SP1"
      }
    ]
  },
  {
    "product": "Trend Micro Worry-Free Business Security",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "10 SP1, Services (SaaS)"
      }
    ]
  }
]

References

success.trendmicro.com/solution/000263632

success.trendmicro.com/solution/000263633

success.trendmicro.com/solution/000267260

www.zerodayinitiative.com/advisories/ZDI-20-1093/

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

33.9%

JSON

Related for CVE-2020-24556