CVE-2020-24557

Warnung

EPSS 2.64%
Veröffentlicht 01.09.2020 19:15:11
Zuletzt bearbeitet 31.10.2025 14:42:20
Erkennungen
Login

A vulnerability in Trend Micro Apex One and Worry-Free Business Security 10.0 SP1 on Microsoft Windows may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function and attain privilege escalation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Please note that version 1909 (OS Build 18363.719) of Microsoft Windows 10 mitigates hard links, but previous versions are affected.

Betroffene Produkte Warnungen 1 Metriken 4 CWE 0 Referenzen 7

NVD 3 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Trendmicro ≫ Apex One Version - SwEdition saas

Microsoft ≫ Windows Version -

Trendmicro ≫ Apex One Version 2019

Microsoft ≫ Windows Version -

Trendmicro ≫ Worry-free Business Security Version 10.0 Update sp1

Microsoft ≫ Windows Version -

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Trend Micro Multiple Products Improper Access Control Vulnerability

Schwachstelle

Trend Micro Apex One, OfficeScan, and Worry-Free Business Security on Microsoft Windows contain an improper access control vulnerability that may allow an attacker to manipulate a particular product folder to disable the security temporarily, abuse a specific Windows function, and attain privilege escalation.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	2.64%	0.836

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST	7.2	3.9	10	AV:L/AC:L/Au:N/C:C/I:C/A:C
CISA-ADP	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H