PT-2021-3229 · Trend Micro · Trend Micro Officescan Xg Sp1+2

Published 2021-04-13 · Updated 2021-04-14 · CVE-2021-28646

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One (affected versions not specified) Trend Micro Apex One as a Service (affected versions not specified) Trend Micro OfficeScan XG SP1 (affected versions not specified)

Description The issue is related to insecure file permissions, which could allow a local attacker to take control of a specific log file on affected installations. It is also associated with insufficient permission assignment checks for a critical resource, potentially leading to a denial of service.

Recommendations For Trend Micro Apex One, consider restricting access to critical log files until a fix is available. For Trend Micro Apex One as a Service, restrict access to critical log files until a fix is available. For Trend Micro OfficeScan XG SP1, restrict access to critical log files until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2021-02930

CVE-2021-28646

Affected Products

Trend Micro Apex One

Trend Micro Apex One As A Service

Trend Micro Officescan Xg Sp1

References · 5

• https://osv.dev/vulnerability/CVE-2021-28646 · Vendor Advisory
• https://success.trendmicro.com/solution/000286157 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28646 · Security Note
• https://success.trendmicro.com/solution/000286019 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02930 · Security Note