CVE-2022-24679
Severity CVSS v4.0:
Pending analysis
Type:
CWE-59
Link Following
Publication date:
24/02/2022
Last modified:
03/03/2022
Description
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local attacker to create an writable folder in an arbitrary location and escalate privileges affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Base Score 2.0
7.20
Severity 2.0
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:trendmicro:apex_one:-:*:*:*:saas:*:*:* | ||
| cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:* | ||
| cpe:2.3:a:trendmicro:worry-free_business_security:10.0:sp1:*:*:*:*:*:* | ||
| cpe:2.3:a:trendmicro:worry-free_business_security_services:-:*:*:*:saas:*:*:* | ||
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page