PT-2022-15862 · Trend Micro · Deep Security Manager+2

Carl Fabian Luepke + 1 · Published 2022-01-20 · Updated 2022-02-03 · CVE-2022-23119

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux versions 20 and below

Description A directory traversal issue could allow an attacker to read arbitrary files from the file system. The attacker must first obtain compromised access to the target Deep Security Manager (DSM) or the target agent must be not yet activated or configured in order to exploit this issue.

Recommendations For versions 20 and below, ensure the Deep Security Manager (DSM) and agents are properly secured and configured to prevent unauthorized access. As a temporary workaround, consider restricting access to sensitive files and directories until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-23119

Affected Products

Cloud One - Workload Security Agent For Linux

Deep Security Manager

Trend Micro Deep Security

References · 8

• 🔥 https://modzero.com/advisories/MZ-21-02-Trendmicro.txt · Exploit
• https://osv.dev/vulnerability/CVE-2022-23119 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23119 · Security Note
• https://success.trendmicro.com/solution/000290104 · Vendor Advisory
• https://t.me/cibsecurity/35948 · Telegram Post
• https://t.me/cvenotify/25921 · Telegram Post
• https://t.me/cybersecuritytechnologies/5247 · Telegram Post
• https://t.me/true_secator/2588 · Telegram Post