CVE-2022-40139Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability
Explotación conocida — Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability
CISA confirmó el 15.09.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 06.10.2022.
Acción requerida: Apply updates per vendor instructions. https://success.trendmicro.com/dcx/s/solution/000291528?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2022-40139
Descripción
Improper validation of some components used by the rollback mechanism in Trend Micro Apex One and Trend Micro Apex One as a Service clients could allow a Apex One server administrator to instruct affected clients to download an unverified rollback package, which could lead to remote code execution. Please note: an attacker must first obtain Apex One server administration console access in order to exploit this vulnerability.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Trend Micro | Trend Micro Apex One | 2019 (on-prem) and SaaS | |
| trendmicro | apex one | 2019 |
Referencias y parches
- https://success.trendmicro.com/solution/000291528 PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-40139 US Government Resource
Coincidencias CPE (NVD) (2)
cpe:2.3:a:trendmicro:apex_one:-:*:*:*:saas:*:*:*cpe:2.3:a:trendmicro:apex_one:2019:*:*:*:*:*:*:*