Lucene search

TrendmicroCVE-2022-36336

HistoryJul 30, 2022 - 12:15 a.m.

CVE-2022-36336

2022-07-3000:15:08

CWE-59

trendmicro

web.nvd.nist.gov

cve-2022-36336

vulnerability

scanning function

trend micro

apex one

worry-free business security

escalation of privileges

activeupdate

spyware pattern

nvd

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

15.9%

JSON

A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalate privileges on affected installations. The resolution for this issue has been deployed automatically via ActiveUpdate to customers in an updated Spyware pattern. Customers who are up-to-date on detection patterns are not required to take any additional steps to mitigate this issue.

Affected configurations

Nvd

Node

trendmicroapex_oneMatch-saas

trendmicroapex_oneMatch2019

trendmicroworry-free_business_securityMatch10.0sp1

trendmicroworry-free_business_security_servicesMatch-saas

AND

microsoftwindowsMatch-

VendorProductVersionCPE
trendmicroapex_one-cpe:2.3:a:trendmicro:apex_one:-:*:*:*:saas:*:*:*
trendmicroapex_one2019cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*
trendmicroworry-free_business_security10.0cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:*
trendmicroworry-free_business_security_services-cpe:2.3:a:trendmicro:worry-free_business_security_services:-:*:*:*:saas:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	apex_one	-	cpe:2.3:a:trendmicro:apex_one:-::::saas:::
trendmicro	apex_one	2019	cpe:2.3:a:trendmicro:apex_one:2019:::::::*
trendmicro	worry-free_business_security	10.0	cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1::::::
trendmicro	worry-free_business_security_services	-	cpe:2.3:a:trendmicro:worry-free_business_security_services:-::::saas:::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "product": "Trend Micro Apex One",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "2019 and SaaS"
      }
    ]
  },
  {
    "product": "Trend Micro Worry-Free Business Security",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "10.0 SP1 and SaaS"
      }
    ]
  }
]

References

success.trendmicro.com/solution/000291267

www.zerodayinitiative.com/advisories/ZDI-22-1033/

Social References

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

15.9%

JSON

Related for CVE-2022-36336