Published:2022/12/23  Last Updated:2022/12/23

JVNVU#96679793
Multiple vulnerabilities in Trend Micro Apex One and Apex One as a Service

Overview

Trend Micro Incorporated has released security updates for Apex One and Apex One as a Service.

Products Affected

  • Apex One On Premise (2019)
  • Apex One as a Service

Description

Trend Micro Incorporated has released security updates for Apex One and Apex One as a Service.

Impact

  • Privilege escalation and file deletion in Damage Cleanup Engine component
  • Privilege escalation due to a link following vulnerability in Damage Cleanup Engine component

Solution

Apply the Patch
Apply the patch according to the information provided by the developer.
The developer has released the following patch to fix these vulnerabilities.

  • Trend Micro Apex One On Premise (2019) Service Pack 1 Critical Patch b11136
The issues in Trend Micro Apex One as a Service are already fixed in November 2022 updates (Agent 14.0.11840).

Apply the Workaround
Applying the following workaround may mitigate the impact of these vulnerabilities.
  • Permit access to the product only from the trusted network

Vendor Status

Vendor Link
Trend Micro Incorporated SECURITY BULLETIN: December 1, 2022, Security Bulletin for Trend Micro Apex One

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE
JVN iPedia