8.8Hoch
KEV
CVE-2020-8467Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
Bekannt ausgenutzt — Trend Micro Apex One and OfficeScan Remote Code Execution Vulnerability
CISA hat am 03.11.2021 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.05.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-8467
Beschreibung
A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to execute arbitrary code on affected installations (RCE). An attempted attack requires user authentication.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Trend Micro | Trend Micro OfficeScan, Trend Micro Apex One | OfficeScan XG (12.0), Apex One 2019 (14.0) | |
| trendmicro | apex one | 2019 | |
| trendmicro | officescan | xg |
Referenzen und Patches
- https://success.trendmicro.com/solution/000245571 PatchVendor Advisory
- https://success.trendmicro.com/jp/solution/000244253 PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8467 US Government Resource
CPE-Treffer (NVD) (3)
cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*cpe:2.3:a:trendmicro:officescan:xg:-:*:*:*:*:*:*cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*