7.8

CVE-2023-52337

An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Trendmicro ≫ Deep Security Version 20.0 Update -
Trendmicro ≫ Deep Security Agent Version 20.0 Update update1337 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update1559 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update158 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update167 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update1681 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update173 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update180 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update182 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update1822 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update183 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update1876 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update190 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update198 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2009 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update208 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update213 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2204 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update223 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update224 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2419 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2593 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2740 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update2921 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3165 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3288 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3445 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3530 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3771 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update3964 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update4185 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update4416 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update4726 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update4959 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5137 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5394 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5512 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5810 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update5995 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update6313 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update6690 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update6860 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update7119 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update7303 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update7476 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update7719 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update7943 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update8137 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update8268 SwEdition long_term_support
Trendmicro ≫ Deep Security Agent Version 20.0 Update update877 SwEdition long_term_support
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.151
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA-ADP 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

https://success.trendmicro.com/dcx/s/solution/000296337?language=en_US
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-24-075/
Third Party Advisory
VDB Entry