PT-2019-15261 · Trend Micro · Trend Micro Apex One

Published 2019-10-28 · Updated 2021-07-21 · CVE-2019-18188

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One (affected versions not specified)

Description The issue allows an attacker to exploit a command injection vulnerability, potentially leading to the extraction of files from an arbitrary zip file to a specific folder on the Apex One server. This could result in remote code execution (RCE). However, the remote process execution is restricted to the IUSR account, which has limited permissions and cannot make significant system changes. An attempted attack requires the attacker to have user authentication.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2019-18188

Affected Products

Trend Micro Apex One

References · 3

• https://osv.dev/vulnerability/CVE-2019-18188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18188 · Security Note
• https://success.trendmicro.com/solution/000151731 · Vendor Advisory