Lucene search

TrendmicroCVE-2022-27883

HistoryApr 09, 2022 - 12:15 a.m.

CVE-2022-27883

2022-04-0900:15:08

CWE-59

trendmicro

web.nvd.nist.gov

cve-2022-27883

vulnerability

trend micro

antivirus

mac

symlink

privilege escalation

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

23.3%

JSON

A link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to create a specially-crafted file as a symlink that can lead to privilege escalation. Please note that an attacker must at least have low-level privileges on the system to attempt to exploit this vulnerability.

Affected configurations

Nvd

Node

trendmicroantivirus_for_macRange≤11.5

VendorProductVersionCPE
trendmicroantivirus_for_mac*cpe:2.3:a:trendmicro:antivirus_for_mac:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	antivirus_for_mac	*	cpe:2.3:a:trendmicro:antivirus_for_mac::::::::

CNA Affected

[
  {
    "product": "Trend Micro Antivirus for Mac",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "11.5"
      }
    ]
  }
]

References

helpcenter.trendmicro.com/en-us/article/tmka-10978

www.zerodayinitiative.com/advisories/ZDI-22-546/

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

23.3%

JSON

Related for CVE-2022-27883