CVE-2022-44651

A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

CVSS v3 7.0 HIGH

7.0^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://success.trendmicro.com/solution/000291770	Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1620/	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:trendmicro:apex_one:::::saas:::*
	cpe:2.3:a:trendmicro:apex_one:2019:-::::::

History

07 Nov 2023, 03:54

Type	Values Removed	Values Added
Summary	A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.	A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Information

Published : 2022-12-12 13:15

Updated : 2024-02-28 19:51

NVD link : CVE-2022-44651

Mitre link : CVE-2022-44651

CVE.ORG link : CVE-2022-44651

JSON object : View

Products Affected

trendmicro

apex_one

CWE

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

7.0 /10