PT-2022-23313 · Trend Micro · Worry-Free Business Security+1

Abdelhamid Naceri · Published 2022-07-28 · Updated 2022-08-09 · CVE-2022-36336

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One (affected versions not specified) Worry-Free Business Security (affected versions not specified)

Description A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalate privileges on affected installations. The resolution for this issue has been deployed automatically via ActiveUpdate to customers in an updated Spyware pattern. Customers who are up-to-date on detection patterns are not required to take any additional steps to mitigate this issue.

Recommendations For Trend Micro Apex One, ensure that the Spyware pattern is updated to the latest version to resolve the issue. For Worry-Free Business Security, ensure that the Spyware pattern is updated to the latest version to resolve the issue. As a general mitigation measure, keep detection patterns up-to-date to prevent exploitation of this issue.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2022-36336

ZDI-22-1033

Affected Products

Trend Micro Apex One

Worry-Free Business Security

References · 6

• https://zerodayinitiative.com/advisories/ZDI-22-1033 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36336 · Security Note
• https://success.trendmicro.com/solution/000291267 · Vendor Advisory
• https://t.me/cibsecurity/47301 · Telegram Post
• https://t.me/cvenotify/34458 · Telegram Post