9.8Crítica
KEV
CVE-2020-8599Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
Explotación conocida — Trend Micro Apex One and OfficeScan Authentication Bypass Vulnerability
CISA confirmó el 03.11.2021 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 03.05.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2020-8599
Descripción
Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an arbitrary path on affected installations and bypass ROOT login. Authentication is not required to exploit this vulnerability.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Trend Micro | Trend Micro OfficeScan, Trend Micro Apex One | OfficeScan XG (12.0), Apex One 2019 (14.0) | |
| trendmicro | apex one | 2019 | |
| trendmicro | officescan | xg |
Referencias y parches
- https://success.trendmicro.com/solution/000245571 Broken LinkPatchVendor Advisory
- https://success.trendmicro.com/jp/solution/000244253 Broken LinkPatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8599 US Government Resource
Coincidencias CPE (NVD) (3)
cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*cpe:2.3:a:trendmicro:officescan:xg:-:*:*:*:*:*:*cpe:2.3:a:trendmicro:officescan:xg:sp1:*:*:*:*:*:*