Privilege escalation vulnerabilities in Trend Micro Apex One



Published: 2022-05-26
Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2022-30700
CVE-2022-30701
CWE-ID CWE-276
CWE-426
Exploitation vector Local
Public exploit N/A
Vulnerable software
Subscribe
Apex One
Client/Desktop applications / Antivirus software/Personal firewalls

Vendor Trend Micro

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect default permissions

EUVDB-ID: #VU63749

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-30700

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions set on a resource used by the service in the ApexOne Security Agent. A local user with access to the system can view contents of files and directories or modify them.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019 - Patch 6 B10048


CPE2.3 External links

http://www.zerodayinitiative.com/advisories/ZDI-22-790/
http://success.trendmicro.com/dcx/s/solution/000291008?language=en_US

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Untrusted search path

EUVDB-ID: #VU63748

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-30701

CWE-ID: CWE-426 - Untrusted Search Path

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

the vulnerability exists due to untrusted search path within the configuration of OpenSSL. A local user can create a specially crafted configuration file and execute arbitrary code with elevated privileges.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apex One: 2019 - Patch 6 B10048


CPE2.3 External links

http://www.zerodayinitiative.com/advisories/ZDI-22-797/
http://success.trendmicro.com/dcx/s/solution/000291008?language=en_US

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###