CVE-2021-43771

Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerability that could allow an attacker to establish a connection that could lead to full local privilege escalation within the application. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVSS v3 7.8 HIGH
CVSS v2.0 4.6 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://helpcenter.trendmicro.com/en-us/article/TMKA-10832	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1320/	Third Party Advisory VDB Entry
https://helpcenter.trendmicro.com/en-us/article/TMKA-10832	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1320/	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:trendmicro:antivirus:*:*:*:*:*:macos:*:*

History

21 Nov 2024, 06:29

Type	Values Removed	Values Added
References	~~() https://helpcenter.trendmicro.com/en-us/article/TMKA-10832 - Vendor Advisory~~	() https://helpcenter.trendmicro.com/en-us/article/TMKA-10832 - Vendor Advisory
References	~~() https://www.zerodayinitiative.com/advisories/ZDI-21-1320/ - Third Party Advisory, VDB Entry~~	() https://www.zerodayinitiative.com/advisories/ZDI-21-1320/ - Third Party Advisory, VDB Entry

Information

Published : 2021-11-30 12:15

Updated : 2024-11-21 06:29

NVD link : CVE-2021-43771

Mitre link : CVE-2021-43771

CVE.ORG link : CVE-2021-43771

JSON object : View

Products Affected

trendmicro

antivirus

CWE

NVD-CWE-Other

{"id": "CVE-2021-43771", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2021-11-30T12:15:08.750", "references": [{"url": "https://helpcenter.trendmicro.com/en-us/article/TMKA-10832", "tags": ["Vendor Advisory"], "source": "security@trendmicro.com"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1320/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "security@trendmicro.com"}, {"url": "https://helpcenter.trendmicro.com/en-us/article/TMKA-10832", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1320/", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Trend Micro Antivirus for Mac 2021 v11 (Consumer) is vulnerable to an improper access control privilege escalation vulnerability that could allow an attacker to establish a connection that could lead to full local privilege escalation within the application. Please note that an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability."}, {"lang": "es", "value": "Trend Micro Antivirus para Mac 2021 versi\u00f3n v11 (Consumer), es susceptible a una vulnerabilidad de escalada de privilegios por control de acceso inapropiado que podr\u00eda permitir a un atacante establecer una conexi\u00f3n que podr\u00eda conllevar a una escalada de privilegios local completa dentro de la aplicaci\u00f3n. Tenga en cuenta que un atacante debe obtener primero la capacidad de ejecutar c\u00f3digo con pocos privilegios en el sistema de destino para poder explotar esta vulnerabilidad"}], "lastModified": "2024-11-21T06:29:45.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:trendmicro:antivirus:*:*:*:*:*:macos:*:*", "vulnerable": true, "matchCriteriaId": "36F619DA-E903-41D3-9769-62364E3A13AA", "versionEndExcluding": "11.0.2163", "versionStartIncluding": "11.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@trendmicro.com"}