Lucene search

TrendmicroCVE-2022-30700

HistoryMay 27, 2022 - 12:15 a.m.

CVE-2022-30700

2022-05-2700:15:08

CWE-732

trendmicro

web.nvd.nist.gov

cve-2022-30700

trend micro

apex one

apex one as a service

vulnerability

permission assignment

dll

escalation of privileges

local attacker

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

15.9%

JSON

An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Affected configurations

Nvd

Node

trendmicroapex_oneRange<14.0.10349saas

trendmicroapex_oneMatch2019-

AND

microsoftwindowsMatch-

VendorProductVersionCPE
trendmicroapex_one*cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:*:*:*
trendmicroapex_one2019cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:-:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	apex_one	*	cpe:2.3:a:trendmicro:apex_one:::::saas:::*
trendmicro	apex_one	2019	cpe:2.3:a:trendmicro:apex_one:2019::::-:::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "product": "Trend Micro Apex One",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "2019 and SaaS"
      }
    ]
  }
]

References

success.trendmicro.com/solution/000291008

www.zerodayinitiative.com/advisories/ZDI-22-790/

Social References

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

15.9%

JSON

Related for CVE-2022-30700