CVE-2021-36741

Trend Micro Multiple Products Improper Input Validation Vulnerability

Severity Score

8.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

*SSVC

Descriptions

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the product�s management console in order to exploit this vulnerability.

Una vulnerabilidad de comprobación de entrada inapropiada en Trend Micro Apex One, Apex One as a Service, OfficeScan XG y Worry-Free Business Security versión 10.0 SP1, permite a un adjunto remoto cargar archivos arbitrarios en las instalaciones afectadas. Nota: un atacante debe obtener primero la habilidad de iniciar sesión en la consola de administración del producto para poder explotar esta vulnerabilidad

Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows a remote attacker to upload files.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-07-14 CVE Reserved
2021-07-29 CVE Published
2021-11-03 Exploited in Wild
2021-11-17 KEV Due Date
2024-08-04 CVE Updated
2024-08-15 EPSS Updated
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://success.trendmicro.com/jp/solution/000287796	2023-11-07
https://success.trendmicro.com/jp/solution/000287815	2023-11-07
https://success.trendmicro.com/solution/000287819	2023-11-07
https://success.trendmicro.com/solution/000287820	2023-11-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Trendmicro Search vendor "Trendmicro"	Apex One Search vendor "Trendmicro" for product "Apex One"	2019 Search vendor "Trendmicro" for product "Apex One" and version "2019"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Trendmicro Search vendor "Trendmicro"	Worry-free Business Security Search vendor "Trendmicro" for product "Worry-free Business Security"	10.0 Search vendor "Trendmicro" for product "Worry-free Business Security" and version "10.0"	sp1	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Trendmicro Search vendor "Trendmicro"		Officescan Search vendor "Trendmicro" for product "Officescan"				xg Search vendor "Trendmicro" for product "Officescan" and version "xg"		sp1		Affected
Trendmicro Search vendor "Trendmicro"		Officescan Business Security Search vendor "Trendmicro" for product "Officescan Business Security"				10.0 Search vendor "Trendmicro" for product "Officescan Business Security" and version "10.0"		sp1		Affected