PT-2022-20157 · Trend Micro · Trend Micro Password Manager

Kharosx0 · Published 2022-05-11 · Updated 2022-05-25 · CVE-2022-30523

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below

Description The issue allows a low privileged local attacker to delete the contents of an arbitrary folder as SYSTEM, which can then be used for privilege escalation on the affected machine.

Recommendations For Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below, update to a version above 5.0.0.1266 to resolve the issue. As a temporary workaround, consider restricting access to sensitive folders to minimize the risk of exploitation.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2022-30523

ZDI-22-759

Affected Products

Trend Micro Password Manager

References · 5

• https://helpcenter.trendmicro.com/en-us/article/tmka-09071 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-759 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30523 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30523 · Security Note
• https://t.me/cibsecurity/42751 · Telegram Post