Japan Vulnerability NotesJVN:36454862JVN#36454862: Multiple vulnerabilities in Trend Micro Apex One and Trend Micro Apex One as a Service
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.014 Low
EPSS
Percentile
86.3%
Trend Micro Apex One and Trend Micro Apex One as a Service provided by Trend Micro Incorporated contain multiple vulnerabilities listed below.
Improper validation in some components of the rollback mechanism (CWE-20) - CVE-2022-40139
| Version | Vector | Score |
|---|---|---|
| CVSS v3 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | Base Score: 7.2 |
| CVSS v2 | AV:N/AC:L/Au:S/C:P/I:P/A:P | Base Score: 6.5 |
Improper access control (CWE-284) - CVE-2022-40140
| Version | Vector | Score |
|---|---|---|
| CVSS v3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | Base Score: 5.5 |
| CVSS v2 | AV:L/AC:L/Au:S/C:N/I:N/A:C | Base Score: 4.6 |
Information exposure (CWE-200) - CVE-2022-40141
| Version | Vector | Score |
|---|---|---|
| CVSS v3 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L | Base Score: 5.6 |
| CVSS v2 | AV:N/AC:H/Au:N/C:P/I:P/A:P | Base Score: 5.1 |
Improper link resolution before file access (CWE-59) - CVE-2022-40142
| Version | Vector | Score |
|---|---|---|
| CVSS v3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Base Score: 7.8 |
| CVSS v2 | AV:L/AC:L/Au:S/C:C/I:C/A:C | Base Score: 6.8 |
Improper link resolution before file access (CWE-59) - CVE-2022-40143
| Version | Vector | Score |
|---|---|---|
| CVSS v3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | Base Score: 7.3 |
| CVSS v2 | AV:L/AC:M/Au:S/C:C/I:C/A:C | Base Score: 6.6 |
Improper authentication (CWE-287) - CVE-2022-40144
| Version | Vector | Score |
|---|---|---|
| CVSS v3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H | Base Score: 8.2 |
| CVSS v2 | AV:N/AC:L/Au:N/C:P/I:N/A:P | Base Score: 6.4 |
Trend Micro Incorporated states that attacks exploiting CVE-2022-40139 have been observed.
Impact
- An attacker who can log in to the product’s administration console may execute an arbitrary code - CVE-2022-40139
- An attacker who can log in to the system where the affected product is installed may be able to cause a denial-of-service (DoS) - CVE-2022-40140
- If certain traffic data is intercepted and decoded, some information related to the server may be obtained - CVE-2022-40141
- An attacker who can log in to the system where the affected product is installed may obtain the administrative privilege - CVE-2022-40142, CVE-2022-40143
- If a remote attacker sends a specially crafted request to the affected product, the product’s login authentication may be bypassed - CVE-2022-40144
Solution
Apply the Patch
Apply the patch according to the information provided by the developer.
The developer has released the following patch to fix these vulnerabilities.
- Trend Micro Apex One On Premise (2019) Service Pack 1 b11092/11088
The issues in Trend Micro Apex One as a Service are already fixed in August 2022 updates.
Apply the Workaround
Applying the following workaround may mitigate the impact of these vulnerabilities.
- Permit access to the product only from the trusted network
Products Affected
- Trend Micro Apex One On Premise (2019)
- Trend Micro Apex One as a Service
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.014 Low
EPSS
Percentile
86.3%