CVE-2023-25144

2023-03-1021:15:14

[email protected]

web.nvd.nist.gov

vulnerability

access control

trend micro

elevated privileges

arbitrary directories

ownership

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

15.9%

JSON

An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attacker to gain elevated privileges and create arbitrary directories with arbitrary ownership.

Affected configurations

Nvd

Node

trendmicroapex_oneRange<14.0.11960saas

trendmicroapex_oneMatch2019-

AND

microsoftwindowsMatch-

VendorProductVersionCPE
trendmicroapex_one*cpe:2.3:a:trendmicro:apex_one:*:*:*:*:saas:*:*:*
trendmicroapex_one2019cpe:2.3:a:trendmicro:apex_one:2019:-:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
trendmicro	apex_one	*	cpe:2.3:a:trendmicro:apex_one:::::saas:::*
trendmicro	apex_one	2019	cpe:2.3:a:trendmicro:apex_one:2019:-::::::
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*