9.8Kritisch
KEV
CVE-2022-26871Trend Micro Apex Central Arbitrary File Upload Vulnerability
Bekannt ausgenutzt — Trend Micro Apex Central Arbitrary File Upload Vulnerability
CISA hat am 31.03.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 21.04.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2022-26871
Beschreibung
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
Schwachstellentyp (CWE):
CWE-345
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| Trend Micro | Trend Micro Apex Central | 2019 (on-premise), SaaS | |
| trendmicro | apex central | 2019 | |
| trendmicro | apex one | — |
Referenzen und Patches
- https://success.trendmicro.com/solution/000290678 MitigationPatchVendor Advisory
- https://success.trendmicro.com/jp/solution/000290660 MitigationPatchVendor Advisory
- https://www.jpcert.or.jp/english/at/2022/at220008.html Third Party AdvisoryVDB Entry
- https://jvn.jp/vu/JVNVU99107357 Third Party AdvisoryVDB Entry
- https://appweb.trendmicro.com/supportNews/NewsDetail.aspx?id=4435 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26871 US Government Resource
CPE-Treffer (NVD) (2)
cpe:2.3:a:trendmicro:apex_central:2019:-:*:*:*:*:*:*cpe:2.3:a:trendmicro:apex_one:-:*:*:*:*:saas:*:*