Lucene search

TrendmicroCVE-2021-3848

HistoryOct 06, 2021 - 10:15 a.m.

CVE-2021-3848

2021-10-0610:15:08

trendmicro

web.nvd.nist.gov

cve-2021-3848

file creation

privilege escalation

trend micro

vulnerability

nvd

security advisory

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.9

Confidence

High

EPSS

Percentile

5.1%

JSON

An arbitrary file creation by privilege escalation vulnerability in Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Business Security Services could allow a local attacker to create an arbitrary file with higher privileges that could lead to a denial-of-service (DoS) on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Affected configurations

Nvd

Node

microsoftwindowsMatch-

AND

trendmicroapex_oneMatch2019-

trendmicroworry-free_business_securityMatch10.0sp1

VendorProductVersionCPE
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
trendmicroapex_one2019cpe:2.3:a:trendmicro:apex_one:2019:-:*:*:*:*:*:*
trendmicroworry-free_business_security10.0cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
trendmicro	apex_one	2019	cpe:2.3:a:trendmicro:apex_one:2019:-::::::
trendmicro	worry-free_business_security	10.0	cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1::::::

CNA Affected

[
  {
    "product": "Trend Micro Apex One",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "2019, SaaS"
      }
    ]
  },
  {
    "product": "Trend Micro Worry-Free Business Security",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "10.0 SP1, Services (SaaS)"
      }
    ]
  }
]

References

success.trendmicro.com/solution/000289183

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:N/A:P

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.9

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2021-3848