9.8Crítica
KEV
CVE-2022-26871Trend Micro Apex Central Arbitrary File Upload Vulnerability
Explotación conocida — Trend Micro Apex Central Arbitrary File Upload Vulnerability
CISA confirmó el 31.03.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 21.04.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2022-26871
Descripción
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
Debilidad (CWE):
CWE-345
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Trend Micro | Trend Micro Apex Central | 2019 (on-premise), SaaS | |
| trendmicro | apex central | 2019 | |
| trendmicro | apex one | — |
Referencias y parches
- https://success.trendmicro.com/solution/000290678 MitigationPatchVendor Advisory
- https://success.trendmicro.com/jp/solution/000290660 MitigationPatchVendor Advisory
- https://www.jpcert.or.jp/english/at/2022/at220008.html Third Party AdvisoryVDB Entry
- https://jvn.jp/vu/JVNVU99107357 Third Party AdvisoryVDB Entry
- https://appweb.trendmicro.com/supportNews/NewsDetail.aspx?id=4435 Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-26871 US Government Resource
Coincidencias CPE (NVD) (2)
cpe:2.3:a:trendmicro:apex_central:2019:-:*:*:*:*:*:*cpe:2.3:a:trendmicro:apex_one:-:*:*:*:*:saas:*:*