PT-2022-1635 · Trend Micro · Trend Micro Worry-Free Business Security Services+3
Abdelhamid Naceri
·
Published
2022-02-15
·
Updated
2022-03-03
·
CVE-2022-24679
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Trend Micro Apex One versions 10.0 SP1 and earlier
Trend Micro Apex One as a Service versions prior to the fixed version
Trend Micro Worry-Free Business Security 10.0 SP1 and earlier
Trend Micro Worry-Free Business Security Services agents versions prior to the fixed version
Description
A local privilege escalation vulnerability could allow a local attacker to create a writable folder in an arbitrary location and escalate privileges on affected installations. The attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this issue. The vulnerability is related to an incorrect link following mechanism before accessing a file.
Recommendations
For Trend Micro Apex One version 10.0 SP1, update to a version that includes the fix for this issue.
For Trend Micro Apex One as a Service, update to a version that includes the fix for this issue.
For Trend Micro Worry-Free Business Security 10.0 SP1, update to a version that includes the fix for this issue.
For Trend Micro Worry-Free Business Security Services agents, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to sensitive areas of the system to minimize the risk of exploitation.
Fix
LPE
Link Following
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Trend Micro Apex One
Trend Micro Apex One As A Service
Trend Micro Worry-Free Business Security
Trend Micro Worry-Free Business Security Services