#VU67207 Insufficient verification of data authenticity in Apex One - CVE-2022-40139
Published: September 13, 2022
Vulnerability identifier: #VU67207
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2022-40139
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerable software:
Apex One
Apex One
Software vendor:
Trend Micro
Trend Micro
Description
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to improper input validation within the rollback functionality. A remote authenticated user with access to the administrative console can force the agent into downloading unverified rollback components and compromise the affected system.
Note, the vulnerability is being actively exploited in the wild.
Remediation
Install updates from vendor's website.