PT-2020-16592 · Trend Micro · Trend Micro Antivirus For Mac

Cees Elzinga · Published 2020-10-14 · Updated 2020-10-26 · CVE-2020-27013

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Antivirus for Mac 2020 (Consumer)

Description The issue occurs due to improper access control in the product's webserver API, allowing an attacker to read and write sensitive product and user data. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system.

Recommendations For Trend Micro Antivirus for Mac 2020 (Consumer), consider restricting access to the webserver API until a patch is available. As a temporary workaround, limit the ability to execute low-privileged code on the target system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-27013

ZDI-20-1243

Affected Products

Trend Micro Antivirus For Mac

References · 4

• https://zerodayinitiative.com/advisories/ZDI-20-1243 · Security Note
• https://helpcenter.trendmicro.com/en-us/article/TMKA-09950 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27013 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27013 · Security Note