An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges and delete files on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex One prior to SP1 (Server Build 11136 and Agent Build 11136). It is, therefore, affected by multiple vulnerabilities:

  - An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One     and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges and delete files     on affected installations. Please note: an attacker must first obtain the ability to execute     low-privileged code on the target system in order to exploit this vulnerability. (CVE-2022-45797)

  - A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend     Micro Apex One as a Service could allow a local attacker to escalate privileges by creating a symbolic     link and abusing the service to delete a file. Please note: an attacker must first obtain the ability to     execute low-privileged code on the target system in order to exploit this vulnerability. (CVE-2022-45798)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version   number.

Detections

Analytics

CVE-2022-45797

high

Tenable Plugins

high