JVN#37183636: Trend Micro Password Manager vulnerable to information disclosure

Password Manager provided by Trend Micro Incorporated generates a key pair and a root certificate on product installation.
The generated private key is not properly protected and any non-administrative user can retrieve the private key (CWE-200).

Impact

A malicious user who obtains the private key can generate a crafted server certificate to conduct a phishing attack to this PC’s other users.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• Password Manager Windows version 5.0.0.1076 and earlier
• Password Manager MacOS versions 5.0.1047 and earlier
  According to the developer, Password Manager for Android and Password Manager for iOS are not affected by this vulnerability.