CVE-2021-36742

Trend Micro Multiple Products Improper Input Validation Vulnerability

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

*SSVC

Descriptions

A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allows a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Una vulnerabilidad de comprobación de entrada inapropiada en Trend Micro Apex One, Apex One as a Service, OfficeScan XG y Worry-Free Business Security versión 10.0 SP1, permite a un atacante local escalar privilegios en las instalaciones afectadas. Nota: un atacante debe obtener primero la habilidad de ejecutar código poco privilegiado en el sistema objetivo para poder explotar esta vulnerabilidad

Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security contain an improper input validation vulnerability that allows for privilege escalation.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-07-14 CVE Reserved
2021-07-29 CVE Published
2021-11-03 Exploited in Wild
2021-11-17 KEV Due Date
2023-03-07 EPSS Updated
2024-08-04 CVE Updated
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://success.trendmicro.com/jp/solution/000287796	2021-08-06
https://success.trendmicro.com/jp/solution/000287815	2021-08-06
https://success.trendmicro.com/solution/000287819	2021-08-06
https://success.trendmicro.com/solution/000287820	2021-08-06

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Trendmicro Search vendor "Trendmicro"	Apex One Search vendor "Trendmicro" for product "Apex One"	2019 Search vendor "Trendmicro" for product "Apex One" and version "2019"	-	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Trendmicro Search vendor "Trendmicro"	Worry-free Business Security Search vendor "Trendmicro" for product "Worry-free Business Security"	10.0 Search vendor "Trendmicro" for product "Worry-free Business Security" and version "10.0"	sp1	Affected	in	Microsoft Search vendor "Microsoft"	Windows Search vendor "Microsoft" for product "Windows"	-	-	Safe
Trendmicro Search vendor "Trendmicro"		Officescan Search vendor "Trendmicro" for product "Officescan"				xg Search vendor "Trendmicro" for product "Officescan" and version "xg"		sp1		Affected
Trendmicro Search vendor "Trendmicro"		Officescan Business Security Search vendor "Trendmicro" for product "Officescan Business Security"				10.0 Search vendor "Trendmicro" for product "Officescan Business Security" and version "10.0"		sp1		Affected