PT-2019-15261 · Trend Micro · Trend Micro Apex One

Publicado 2019-10-28 · Atualizado 2021-07-21 · CVE-2019-18188

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One (affected versions not specified)

Description The issue allows an attacker to exploit a command injection vulnerability, potentially leading to the extraction of files from an arbitrary zip file to a specific folder on the Apex One server. This could result in remote code execution (RCE). However, the remote process execution is restricted to the IUSR account, which has limited permissions and cannot make significant system changes. An attempted attack requires the attacker to have user authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2019-18188

Produtos afetados

Trend Micro Apex One

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-18188 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-18188 · Nota de Segurança
• https://success.trendmicro.com/solution/000151731 · Aviso do Fabricante