CVE-2022-36336

2022-07-3000:15:08

CWE-59

[email protected]

web.nvd.nist.gov

cve-2022-36336

vulnerability

scanning function

trend micro

apex one

worry-free business security

escalation of privileges

activeupdate

spyware pattern

nvd

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

16.0%

JSON

A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalate privileges on affected installations. The resolution for this issue has been deployed automatically via ActiveUpdate to customers in an updated Spyware pattern. Customers who are up-to-date on detection patterns are not required to take any additional steps to mitigate this issue.

Affected configurations

NVD

Node

trendmicroapex_oneMatch-saas

trendmicroapex_oneMatch2019

trendmicroworry-free_business_securityMatch10.0sp1

trendmicroworry-free_business_security_servicesMatch-saas

AND

microsoftwindowsMatch-

CPENameOperatorVersion
trendmicro:apex_onetrendmicro apex oneeq-
trendmicro:apex_onetrendmicro apex oneeq2019
trendmicro:worry-free_business_securitytrendmicro worry-free business securityeq10.0
trendmicro:worry-free_business_security_servicestrendmicro worry-free business security serviceseq-

CPE	Name	Operator	Version
trendmicro:apex_one	trendmicro apex one	eq	-
trendmicro:apex_one	trendmicro apex one	eq	2019
trendmicro:worry-free_business_security	trendmicro worry-free business security	eq	10.0
trendmicro:worry-free_business_security_services	trendmicro worry-free business security services	eq	-

CNA Affected

[
  {
    "product": "Trend Micro Apex One",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "2019 and SaaS"
      }
    ]
  },
  {
    "product": "Trend Micro Worry-Free Business Security",
    "vendor": "Trend Micro",
    "versions": [
      {
        "status": "affected",
        "version": "10.0 SP1 and SaaS"
      }
    ]
  }
]