Lucene search

TrendmicroCVE-2023-25144

HistoryMar 10, 2023 - 9:15 p.m.

CVE-2023-25144

2023-03-1021:15:14

trendmicro

web.nvd.nist.gov

access control

vulnerability

trend micro

apex one

local attacker

elevated privileges

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

15.9%

JSON

An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attacker to gain elevated privileges and create arbitrary directories with arbitrary ownership.

Affected configurations

Nvd

Node

trendmicroapex_oneRange<14.0.11960saas

trendmicroapex_oneMatch2019-

AND

microsoftwindowsMatch-

VendorProductVersionCPE
trendmicroapex_one*cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:*:*:*
trendmicroapex_one2019cpe:2.3:a:trendmicro:apex_one:2019:-:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	apex_one	*	cpe:2.3:a:trendmicro:apex_one:::::saas:::*
trendmicro	apex_one	2019	cpe:2.3:a:trendmicro:apex_one:2019:-::::::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "vendor": "Trend Micro, Inc.",
    "product": "Trend Micro Apex One",
    "versions": [
      {
        "version": "2019 (14.0)",
        "status": "affected",
        "versionType": "semver",
        "lessThan": "14.0.0.11564"
      }
    ]
  }
]

References

success.trendmicro.com/solution/000292209

www.zerodayinitiative.com/advisories/ZDI-23-171/

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

Percentile

15.9%

JSON

Related for CVE-2023-25144