CVE-2020-27697

Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges (symlink attack) which can lead to obtaining administrative privileges during the installation of the product.

CVSS v3 7.8 HIGH
CVSS v2.0 6.9 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://helpcenter.trendmicro.com/en-us/article/TMKA-10036	Vendor Advisory
https://helpcenter.trendmicro.com/en-us/article/TMKA-10036	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:trendmicro:antivirus\+_security_2020::::::::
	cpe:2.3:a:trendmicro:internet_security_2020::::::::
	cpe:2.3:a:trendmicro:maximum_security_2020::::::::
	cpe:2.3:a:trendmicro:premium_security_2020::::::::

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:21

Type	Values Removed	Values Added
References	~~() https://helpcenter.trendmicro.com/en-us/article/TMKA-10036 - Vendor Advisory~~	() https://helpcenter.trendmicro.com/en-us/article/TMKA-10036 - Vendor Advisory

Information

Published : 2020-11-18 19:15

Updated : 2024-11-21 05:21

NVD link : CVE-2020-27697

Mitre link : CVE-2020-27697

CVE.ORG link : CVE-2020-27697

JSON object : View

Products Affected

trendmicro

antivirus\+_security_2020
internet_security_2020
premium_security_2020
maximum_security_2020

microsoft

windows

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2020-27697", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-11-18T19:15:11.460", "references": [{"url": "https://helpcenter.trendmicro.com/en-us/article/TMKA-10036", "tags": ["Vendor Advisory"], "source": "security@trendmicro.com"}, {"url": "https://helpcenter.trendmicro.com/en-us/article/TMKA-10036", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "Trend Micro Security 2020 (Consumer) contains a vulnerability in the installer package that could be exploited by placing a malicious DLL in a non-protected location with high privileges (symlink attack) which can lead to obtaining administrative privileges during the installation of the product."}, {"lang": "es", "value": "Trend Micro Security 2020 (Consumer), contiene una vulnerabilidad en el paquete de instalaci\u00f3n que podr\u00eda ser explotada al colocar una DLL maliciosa en una ubicaci\u00f3n no protegida con altos privilegios (ataque de tipo symlink) que puede conllevar a una obtenci\u00f3n de privilegios administrativos durante la instalaci\u00f3n del producto"}], "lastModified": "2024-11-21T05:21:40.507", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:antivirus\\+_security_2020:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C00561E3-418B-4FCD-B1F4-E2ABBB283D82", "versionEndIncluding": "16.0"}, {"criteria": "cpe:2.3:a:trendmicro:internet_security_2020:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D2DD545-14EE-4244-9941-DE9423BAEFE1", "versionEndIncluding": "16.0"}, {"criteria": "cpe:2.3:a:trendmicro:maximum_security_2020:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DD354AF-05D4-434F-9195-D4029AC65001", "versionEndIncluding": "16.0"}, {"criteria": "cpe:2.3:a:trendmicro:premium_security_2020:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B92B18B-6DF1-4924-804C-96ABCBEFBE65", "versionEndIncluding": "16.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security@trendmicro.com"}